Support CA store selection in bunfig.toml

[robobun]

Fixes #30313

Related: #17325, #17108. This PR only makes the existing CA-store selection configurable in bunfig.toml. It does not extend that selection to bun install or add new TLS env var handling, so those issues stay open.

Feature

Adds a top-level CA key to bunfig.toml that accepts "system", "openssl", or "bundled":

# bunfig.toml
CA = "system"

So users can set a default once instead of passing --use-system-ca (or --use-openssl-ca / --use-bundled-ca) on every bun run.

Applied to run, auto, and test commands.

Precedence

CLI flag > NODE_USE_SYSTEM_CA env var > bunfig.toml CA > bundled (default).

The existing CLI error about "choose exactly one" still fires only when multiple CLI flags are passed together. A bunfig value that disagrees with a CLI flag or env var just gets overridden silently, matching the existing NODE_USE_SYSTEM_CA behavior.

Implementation

• src/options_types/Context.zig: moves the BunCAStore enum here and adds runtime_options.ca_store: ?BunCAStore so bunfig can stash the parsed value without forcing a write to the exported global.
• src/cli/bunfig.zig: new parser branch for the top-level CA / ca key (string-valued for easier validation than three booleans). Emits a diagnostic on unknown values.
• src/cli/Arguments.zig: CA-flag block now consults ctx.runtime_options.ca_store as the lowest-precedence source after the CLI flags and NODE_USE_SYSTEM_CA.
• src/cli/cli.zig: exposes Command.BunCAStore alongside the other context-type aliases.

Verification

Extends test/js/node/tls/test-use-system-ca.test.ts with:

• CA = "system" in bunfig matches --use-system-ca's cert count
• CA = "bundled" matches the plain default
• CA = "openssl" is accepted without error
• CLI --use-bundled-ca wins over CA = "system" in bunfig
• NODE_USE_SYSTEM_CA=1 wins over CA = "bundled" in bunfig
• Unknown CA values emit a diagnostic and exit non-zero
• bun test reads the bunfig value too

$ bun bd test test/js/node/tls/test-use-system-ca.test.ts
 11 pass
 0 fail
 44 expect() calls

Against the baked bun (no fix), the two key tests fail — CA = "system" produces the bundled-only count (145) instead of 448 with system certs, and the invalid-value test exits 0 because the key is silently ignored.

---

[review] gate passed · iteration 16 · 7 files touched

fails on main (without fix)

ASAN without fix: 4 FAILED
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/js/node/tls/test-use-system-ca.test.ts
bun test v1.4.0 (205cd0c5d)

test/js/node/tls/test-use-system-ca.test.ts:
(pass) --use-system-ca > flag loads system certificates [279.88ms]
(pass) --use-system-ca > NODE_USE_SYSTEM_CA=1 loads system certificates [279.36ms]
(pass) --use-system-ca > NODE_USE_SYSTEM_CA=0 doesn't load system certificates [283.47ms]
(pass) --use-system-ca > --use-system-ca overrides NODE_USE_SYSTEM_CA=0 [275.24ms]
(pass) bunfig.toml CA > CA = "openssl" in bunfig.toml matches --use-openssl-ca [2016.58ms]
(pass) bunfig.toml CA > CLI --use-bundled-ca overrides bunfig CA = "system" [2025.93ms]
(pass) bunfig.toml CA > CA = "bundled" in bunfig.toml matches bundled-only default [2104.70ms]
129 |     });
130 |     const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
131 |     expect(stderr).toBe("");
132 |     const runCount = parseInt(stdout.trim(), 10);
133 |     const flagCount = await defaultCertCount(["--use-system-ca"]);
134 |     expect(runCount).toBe(flagCou
... (truncated)

release without fix: 4 FAILED
bun test v1.4.0-canary.1 (b7a043103)

test/js/node/tls/test-use-system-ca.test.ts:
(pass) --use-system-ca > flag loads system certificates [7.81ms]
(pass) --use-system-ca > NODE_USE_SYSTEM_CA=1 loads system certificates [7.41ms]
(pass) --use-system-ca > NODE_USE_SYSTEM_CA=0 doesn't load system certificates [6.78ms]
(pass) --use-system-ca > --use-system-ca overrides NODE_USE_SYSTEM_CA=0 [7.08ms]
193 |       stdout: "pipe",
194 |       stderr: "pipe",
195 |     });
196 | 
197 |     const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
198 |     expect(stdout).not.toContain("should not run");
                             ^
error: expect(received).not.toContain(expected)

Expected to not contain: "should not run"
Received: "should not run\n"

      at <anonymous> (/workspace/bun/test/js/node/tls/test-use-system-ca.test.ts:198:24)
(fail) bunfig.toml CA > invalid CA value fails with a diagnostic [8.73ms]
(pass) bunfig.toml CA > CA = "bundled" in bunfig.toml matches bundled-only default [46.78ms]
(pass) bunfig.toml CA > CA = "openssl" in bunfig.toml matches --use-openssl-ca [46.21ms]
(pass) bunfig.toml CA > CLI --use-b
... (truncated)

passes on PR (with fix)

ASAN with fix: all passed
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/js/node/tls/test-use-system-ca.test.ts
bun test v1.4.0 (205cd0c5d)

test/js/node/tls/test-use-system-ca.test.ts:
(pass) --use-system-ca > flag loads system certificates [277.58ms]
(pass) --use-system-ca > NODE_USE_SYSTEM_CA=1 loads system certificates [272.62ms]
(pass) --use-system-ca > NODE_USE_SYSTEM_CA=0 doesn't load system certificates [277.89ms]
(pass) --use-system-ca > --use-system-ca overrides NODE_USE_SYSTEM_CA=0 [276.97ms]
(pass) bunfig.toml CA > CA = "openssl" in bunfig.toml matches --use-openssl-ca [2064.14ms]
(pass) bunfig.toml CA > CA = "bundled" in bunfig.toml matches bundled-only default [2089.30ms]
(pass) bunfig.toml CA > CLI --use-bundled-ca overrides bunfig CA = "system" [2112.72ms]
(pass) bunfig.toml CA > invalid CA value fails with a diagnostic [126.01ms]
(pass) bunfig.toml CA > bun run <file> honors bunfig.toml CA [2521.58ms]
(pass) bunfig.toml CA > CA = "system" in bunfig.toml matches --use-system-ca [3264.45ms]
(pass) bunfig.toml CA > NODE_USE_SYSTEM_CA=1 overrides bunfig CA = "bundled" [2234.04ms]
(pass) bu
... (truncated)

release with fix: all passed
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped)
  target       linux-x64-gnu
  build type   Release
  build dir    ./build/release
  revision     205cd0c5d8
  features     baseline

22 deps, 123 codegen, 1176 objects in 847ms

ninja: Entering directory `/workspace/bun/build/release'
[1/1238] install /workspace/bun
bun install v1.4.0-canary.1 (b7a043103)

Checked 107 installs across 153 packages (no changes) [9.00ms]
[2/1238] gen ErrorCode+*.h
[3/1238] gen bindgenv2
[4/1238] install /workspace/bun/packages/bun-error
bun install v1.4.0-canary.1 (b7a043103)

Checked 1 install across 2 packages (no changes) [2.00ms]
[5/1238] install /workspace/bun/src/node-fallbacks
bun install v1.4.0-canary.1 (b7a043103)

Checked 129 installs across 147 packages (no changes) [11.00ms]
[6/1238] fetch tinycc
[tinycc] up to date
[7/1237] gen ProcessBindingConstants.lut.h
Generating /workspace/bun/build/release/codegen/ProcessBindingConstants.lut.h from /workspace/bun/src/jsc/bindings/ProcessBindingConstants.cpp
[8/1237] fetch libjpeg-turbo
[libjpeg-turbo] up to date
[9/1237] fetch zlib
[zlib] up to date
[10/1237] gen .bind.ts → GeneratedBindings.cpp

... (truncated)

diff hotspot

docs/runtime/bunfig.mdx                     |  17 +++
 src/bunfig/bunfig.rs                        |  28 +++++
 src/options_types/context.rs                |  12 ++
 src/runtime/cli/Arguments.rs                |  45 ++++----
 src/runtime/cli/repl_command.rs             |   2 +
 src/runtime/cli/run_command.rs              |   6 +
 test/js/node/tls/test-use-system-ca.test.ts | 169 +++++++++++++++++++++++++++-
 7 files changed, 258 insertions(+), 21 deletions(-)

gate history · 1 passed · 0 rejected · iteration 16

evidence per changed file

file                                         reads  edits  tests
docs/runtime/bunfig.mdx                          2      2     37
src/bunfig/bunfig.rs                             3      1     37
src/options_types/context.rs                     4      4     37
src/runtime/cli/Arguments.rs                    10     10     37
src/runtime/cli/repl_command.rs                  2      3     37
src/runtime/cli/run_command.rs                   7      5     37
test/js/node/tls/test-use-system-ca.test.ts     11      9     37

[robobun]

^{Updated 7:05 AM PT - Aug 14th, 2026}

❌ @robobun, your commit 205cd0c has some failures in Build #95893 (All Failures)

---

🧪   To try this PR locally:

bunx bun-pr 30314

That installs a local version of the PR into your bun-30314 executable, so you can run:

bun-30314 --bun

[github-actions]

Found 3 issues this PR may fix:

1. Limitations of bun operation in corporate networks: self-signed CA #17325 - Corporate network users need a persistent config to use system CAs for all bun commands; CA = "system" in bunfig.toml directly addresses this
2. FR: Support Loading Certificates from Windows Certificate Store #17108 - Requests an option to load certificates from the OS store instead of bundled certs; bunfig.toml CA = "system" is exactly this feature
3. Drop-in replacement for npm strict-ssl #4979 - User's org registry uses certs trusted by the system store but not Bun's bundled store; CA = "system" in bunfig.toml resolves this

If this is helpful, copy the block below into the PR description to auto-close these issues on merge.

Fixes #17325
Fixes #17108
Fixes #4979

🤖 Generated with Claude Code

[robobun]

Added #17325 and #17108. Skipping #4979 — that thread is asking to disable cert verification (npm strict-ssl false / NODE_TLS_REJECT_UNAUTHORIZED=0), which is a different concern from picking which CA store to trust.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Pins and exposes a CA-store runtime option, parses a CA key from bunfig.toml, and implements a deterministic precedence (CLI flags → NODE_USE_SYSTEM_CA → bunfig.toml → runtime fallback). Adds an apply mechanism and locking to prevent later bunfig overrides; updates CLI wiring, tests, and docs.

Changes

CA Store Configuration and Resolution

Layer / File(s)	Summary
Data Shape src/options_types/Context.zig	Adds public enum BunCAStore (bundled, openssl, system) and optional ca_store: ?BunCAStore = null to RuntimeOptions.
Public API Type Exposure src/cli/cli.zig	Adds pub const BunCAStore inside Command to expose the new type through CLI command/context types.
Public API Restructuring / Exports src/cli/Arguments.zig	Replaces local enum with alias pub const BunCAStore = Command.BunCAStore; keeps pub export var Bun__Node__CAStore: BunCAStore = .bundled; and adds exported pub export var Bun__Node__UseSystemCA (initialized false).
Bunfig Parsing / Wiring src/cli/bunfig.zig	Parses CA/ca for Run/Auto/Test commands (accepts system, openssl, bundled), sets ctx.runtime_options.ca_store accordingly, and emits diagnostics for invalid values.
CA Store Resolution / Locking src/cli/Arguments.zig	Implements precedence for resolving Bun__Node__CAStore: CLI flags → NODE_USE_SYSTEM_CA env → ctx.runtime_options.ca_store (bunfig) → runtime fallback; introduces Bun__Node__CAStore_locked and applyBunfigCAStore(ctx) which applies bunfig value and updates Bun__Node__UseSystemCA.
Command Wiring (apply at load points) src/cli/run_command.zig, src/cli/repl_command.zig	Calls bun.cli.Arguments.applyBunfigCAStore(ctx) after bunfig.toml is loaded in REPL and Run command paths to ensure bunfig CA is applied when appropriate.
Tests / Documentation test/js/node/tls/test-use-system-ca.test.ts, docs/runtime/bunfig.mdx	Adds tests probing CA-store selection and precedence (CLI flags, NODE_USE_SYSTEM_CA, bunfig.toml, invalid values) and documents the new CA bunfig option with values and precedence.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The implementation comprehensively addresses all three linked issues: #30313 (bunfig.toml CA config), #17325 (corporate network/self-signed CA support), and #17108 (OS certificate store support via system option).
Out of Scope Changes check	✅ Passed	All changes are directly scoped to implementing CA store selection in bunfig.toml: core logic, test coverage, and documentation with no unrelated modifications.
Title check	✅ Passed	The title clearly and concisely describes the primary change: adding CA store selection to bunfig.toml.
Description check	✅ Passed	The description explains the feature, precedence, implementation scope, linked issues, and verification results in sufficient detail.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/cli/Arguments.zig`:
- Around line 1046-1056: The env-var branch treats any presence of
NODE_USE_SYSTEM_CA (including "0") as true; change the condition so it checks
the actual value string from bun.env_var.NODE_USE_SYSTEM_CA.get() (e.g., match
on .?value and verify value != "0" and optionally not "false") before setting
Bun__Node__CAStore = .system; update the branch that currently uses
bun.env_var.NODE_USE_SYSTEM_CA.get() to only take effect when the env var's
value is truthy (not "0"/"false"), keeping the other symbols/use_bundled_ca,
use_openssl_ca, use_system_ca, and ctx.runtime_options.ca_store precedence
intact.

In `@test/js/node/tls/test-use-system-ca.test.ts`:
- Around line 125-136: The test currently asserts exitCode before checking
stdout/stderr for the spawned process; update the assertion order in the
spawn-result checks (the block using spawn(...), proc,
Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]) and the
variables stdout, stderr, exitCode) so that you first assert stdout and stderr
expectations (expect(stdout.trim()).toBe("OK"); expect(stderr).toBe("");) and
only then assert expect(exitCode).toBe(0);; make the same reorder in the other
two similar blocks referenced (the blocks around the Promise.all usages at the
other spawn sites).
- Around line 183-210: The test currently only checks that
getCACertificates("default") returns an array which doesn't prove bun test
respected CA = "system"; modify the probe test (probe.test.ts) to export or
print the actual certificate count (e.g., call
getCACertificates("default").length and log it) and in the parent test compare
that numeric value against a known baseline—either the bundled CA baseline or
the value returned by defaultCertCount(["--use-system-ca"])—by spawning bun test
twice (or computing baseline separately) and asserting the spawned test's
printed count differs appropriately when the system CA is selected; update the
spawn invocation and expectations to parse the printed count from stdout and
assert the numeric comparison instead of Array.isArray.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3765f5da-ca3e-49e6-a161-67dbd484f97e

📥 Commits

Reviewing files that changed from the base of the PR and between 611740f and 3e75f1c.

📒 Files selected for processing (5)

• src/cli/Arguments.zig
• src/cli/bunfig.zig
• src/cli/cli.zig
• src/options_types/Context.zig
• test/js/node/tls/test-use-system-ca.test.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/runtime/bunfig.mdx`:
- Around line 120-121: Update the sentence that currently reads "Applies to `bun
run` and `bun test`" so it also includes `bun auto`; locate the sentence in
docs/runtime/bunfig.mdx that mentions the CA certificate store applicability and
change it to explicitly state "Applies to `bun run`, `bun test`, and `bun auto`"
to match the implementation objective.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1cc7ecaa-e596-46a8-923d-438cda844ae7

📥 Commits

Reviewing files that changed from the base of the PR and between 02eae5f and 666f484.

📒 Files selected for processing (1)

• docs/runtime/bunfig.mdx

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/cli/repl_command.zig`:
- Around line 25-29: The call to bun.cli.Arguments.applyBunfigCAStore is
currently guarded by if (!ctx.debug.loaded_bunfig), so when bunfig is already
preloaded the CA from ctx.runtime_options.ca_store never gets copied into
Bun__Node__CAStore; remove the guard or call
bun.cli.Arguments.applyBunfigCAStore(ctx) unconditionally after the existing if
block (keep bun.cli.Arguments.loadConfigPath inside the if) so that
applyBunfigCAStore always runs and ensures ctx.runtime_options.ca_store is
copied into Bun__Node__CAStore regardless of ctx.debug.loaded_bunfig.

In `@test/js/node/tls/test-use-system-ca.test.ts`:
- Around line 77-90: The helper defaultCertCount currently inherits the test
runner's cwd when cwd is omitted, which can pick up an ambient bunfig.toml;
change defaultCertCount (and its use of spawn/bunExe/probe) to run in an
isolated temporary directory when cwd is undefined by creating a fresh temp
folder (e.g., mkdtemp) and passing that path as cwd to spawn; ensure the temp
dir is cleaned up after the proc completes so all calls to defaultCertCount
without an explicit cwd become hermetic.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e3b9c0f5-cbe4-4c0a-af8b-95f4d49e7e6e

📥 Commits

Reviewing files that changed from the base of the PR and between 666f484 and ee2d55f.

📒 Files selected for processing (5)

• docs/runtime/bunfig.mdx
• src/cli/Arguments.zig
• src/cli/repl_command.zig
• src/cli/run_command.zig
• test/js/node/tls/test-use-system-ca.test.ts

[claude]

All prior feedback has been addressed (thanks!) and I found no new issues, but I'm deferring to a human reviewer since this configures TLS trust-store selection and threads a new locked-global through five deferred bunfig-load sites — worth a second pair of eyes on the precedence/ordering.

Extended reasoning...

Overview

This PR adds a top-level CA key to bunfig.toml ("system" / "openssl" / "bundled") as a persistent equivalent to the --use-*-ca CLI flags. It touches 9 files: the bunfig parser, Arguments.zig (precedence logic + new Bun__Node__CAStore_locked global + applyBunfigCAStore() helper), five call sites that invoke applyBunfigCAStore after deferred bunfig loads (run_command.zig, repl_command.zig, bun.js.zig ×2, plus inside parse itself), the Context.zig options struct, cli.zig type re-export, docs, and ~170 lines of new tests.

Over the course of review I flagged two real ordering bugs (the .RunCommand deferred-load gap in ee2d55f and the standalone-executable gap in 9467c48), plus several test-quality and docs nits — all now resolved. The current bug-hunting pass found nothing new.

Security risks

The change selects which root CA store the runtime trusts for TLS verification. The mechanism itself is sound — it only routes between three pre-existing stores (bundled Mozilla, OpenSSL default, OS trust store), all of which were already reachable via CLI flags. The precedence (CLI > env > bunfig > default) is documented and tested, and the _locked flag prevents a late bunfig load from overriding an explicit CLI/env choice. I don't see an exploitable issue, but "which CAs do we trust" is inherently security-sensitive configuration and the multi-site application pattern (five applyBunfigCAStore calls covering different boot paths) is the kind of thing where a missed call site silently degrades to the wrong store — exactly the class of bug this PR already had to fix twice during review.

Level of scrutiny

Medium-high. This is a user-facing feature in production code paths (run/auto/test/repl/standalone), not a config tweak or refactor. The locking mechanism and the need to sprinkle applyBunfigCAStore after every deferred loadConfigPath(..., .RunCommand) is a design decision a maintainer should sign off on — particularly whether there's a cleaner single-point-of-application, and whether the top-level CA key name (vs. nesting under [run] or similar) is the desired surface.

Other factors

Test coverage is thorough for the happy paths and precedence rules across bun <file>, bun run <file>, and bun test. CI shows two unrelated pre-existing flakes (s3-storage-class, http-emit-close-on-abort). All review threads — mine and CodeRabbit's — are resolved. Given the security-adjacent surface and the non-trivial cross-cutting wiring, I'm not auto-approving.

[claude]

All prior feedback has been addressed and I didn't find anything new this round — deferring to a human since this is a security-adjacent feature (TLS CA store selection) with a non-trivial precedence/locking scheme spread across several deferred-load sites in both the Zig and Rust runtimes.

Extended reasoning...

Overview

Adds a top-level CA key to bunfig.toml ("system" / "openssl" / "bundled") as a persistent equivalent to the --use-*-ca flags. Touches 14 files: the bunfig parser (Zig + Rust), RuntimeOptions / BunCAStore type plumbing in options_types/, the CA precedence block in Arguments.{zig,rs}, a new applyBunfigCAStore helper plus a Bun__Node__CAStore_locked flag, call sites in run_command, repl_command, and bun.js.zig (boot / bootStandalone), docs, and tests.

Security risks

This directly controls which CA trust store the runtime uses for TLS verification. The change itself only adds a new source for an existing setting (the values map onto the same three stores already reachable via CLI flags / NODE_USE_SYSTEM_CA), so it doesn't introduce a new trust surface. The main risk is precedence/ordering: a bug here could cause a user's explicit --use-bundled-ca to be silently overridden by a project-local bunfig.toml, or vice versa. The _locked flag addresses exactly that, and the test suite covers CLI-over-bunfig and env-over-bunfig, but the number of distinct entry paths (auto, run, test, repl, standalone, preloaded --config) makes this worth a human pass.

Level of scrutiny

Medium-high. Not a trivial config tweak: it's a user-facing feature in security-adjacent code, the review surfaced two real ordering bugs (the .RunCommand deferred-load gap and the bootStandalone gap) that were fixed mid-review, and the most recent push ports the whole thing to the Rust runtime in parallel. The Zig and Rust implementations need to stay in lockstep.

Other factors

• All five rounds of my prior inline feedback (test assertion ordering, weak bun test assertion, describe.concurrent, missing docs, dead anchors, the bun run deferred-load bug, and the bun.js.zig standalone gap) have been addressed and resolved.
• robobun's CI comment currently shows build-rust failures on several targets for 88e7ded; worth confirming eee21cf (autofix) cleared those before merge.
• Good test coverage for the precedence matrix (CLI > env > bunfig) and for bun run / bun test paths; no coverage for the standalone-executable path, which is harder to test but was fixed by inspection.
• Design choices a maintainer may want to weigh in on: top-level CA key naming (vs. e.g. [run].ca), and accepting both CA and lowercase ca.

[robobun]

CI status: every executed lane passed on 19cacd8. The two remaining reds on build 57692 (darwin-14-aarch64-test-bun, darwin-26-aarch64-test-bun) are both "Expired" — buildkite agents never picked up the jobs within TTL, nothing ran. Prior build 57686 was the same story: libspng tarball 502 from github during an ASAN C++ build, and a streams-leak.test.ts RSS-threshold flake already diagnosed on main in four prior commits (most recently 1346d3e3f7). I used my one CI re-roll on the previous push; per the workflow I wont push another ci: retrigger. Needs a maintainer to re-run or merge.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
bun	🟢 Ready	View Preview	Jun 26, 2026, 1:18 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[robobun]

Rebased onto main and force-pushed (811db1c3ec).

Conflict resolution: main deleted the .zig reference files (Arguments.zig, bunfig.zig, cli.zig, Context.zig, repl_command.zig, run_command.zig, bun.js.zig) as part of the Zig→Rust migration cleanup. My earlier commits had modified those files, producing modify/delete conflicts. I accepted the deletions and kept the .rs implementation (src/bunfig/bunfig.rs, src/options_types/context.rs, src/runtime/cli/{Arguments,run_command,repl_command}.rs), which is what ships. This also resolves the earlier review note about adding behavior to .zig files, those files no longer exist.

Final diff is 7 files: the 5 Rust files, docs/runtime/bunfig.mdx, and test/js/node/tls/test-use-system-ca.test.ts.

Verified the full precedence matrix directly against the debug build (getCACertificates("default").length):

baseline (no flag/env/bunfig): 120   (bundled)
--use-system-ca:               423
bunfig CA="system":            423   (== flag)
bunfig CA="bundled":           120   (== baseline)
bunfig CA="openssl":           120   (== --use-openssl-ca)
bun run <file> + CA="system":  423   (deferred-load path)
NODE_USE_SYSTEM_CA=1 over CA="bundled": 423
--use-bundled-ca over CA="system":      120
invalid CA value: exit 1, "Invalid CA value \"nope\". Expected one of: ..."

Note: bun test currently aborts at startup on this main commit while loading bun:internal-for-testing (Private symbol not found: newZigFunction(..., "TestingAPIs.jsSocketFaultInjectionAvailable", 0)). That file is byte-identical to main and unrelated to this PR; the multi-line $newZigFunction call at internal-for-testing.ts:303 is not being registered by the JS2Native codegen. It reproduces on a fully clean build, so it is a pre-existing codegen issue, not introduced here. The CA feature is validated directly above in the meantime.

[robobun]

Rebased onto latest main (e174a4e5a3) and force-pushed; no merge conflicts remain.

Heads-up for whoever reviews: current main HEAD does not build, independent of this PR. src/js/codegen/generate-js2native.ts now rejects the socket-fault testing bindings because src/js/internal-for-testing.ts calls $newRustFunction("runtime/socket/socket.zig", ...) with a .zig path after the $newZigFunction→$newRustFunction rename:

error: Expected filename for $rust to have .rs extension, got "runtime/socket/socket.zig"
    at resolveNativeFileId (src/codegen/generate-js2native.ts:106:15)
While processing: internal-for-testing.ts

I confirmed this reproduces with every file of this PR reverted to origin/main, so it blocks all builds on this commit, not just this branch. (On the prior main base the same area instead built but crashed bun test at startup loading bun:internal-for-testing.)

The CA feature itself compiles (cargo check -p bun_options_types -p bun_bunfig is clean; full debug+release built on the prior base) and every assertion in the test is validated directly against the debug build:

baseline:120  --use-system-ca:423
bunfig CA="system":423 (==flag)   CA="bundled":120 (==baseline)   CA="openssl":120 (==--use-openssl-ca)
bun run <file> + CA="system":423   NODE_USE_SYSTEM_CA=1 over CA="bundled":423   --use-bundled-ca over CA="system":120
invalid CA value -> exit 1 + "Invalid CA value ..."

Once main's codegen path is fixed, a re-run (or trivial rebase) should go green.

[robobun]

Update: main fixed the codegen path ($newRustFunction now takes the correct .rs filename in internal-for-testing.ts), so the build blocker from my previous comment is gone. Rebased onto the fixed main and force-pushed.

bun bd test test/js/node/tls/test-use-system-ca.test.ts now runs clean: 12 pass / 0 fail. Fail-before verified — reverting my src/ changes yields 4 failures (e.g. bun test honors CA = "system" gets 120 instead of 423), confirming the tests exercise the fix.

[claude]

Re-reviewed after 76d5580 / 205cd0c — the call-site comments are now one line each, so the earlier nit (and the comment-cop warnings) are resolved. No issues found this pass.

Deferring final sign-off to a maintainer since this adds a new user-facing bunfig key (CA) that selects the runtime TLS trust store — the key name, accepted values, and precedence are API surface worth a human confirming.

What was reviewed

• Precedence logic in Arguments.rs: CLI flag / NODE_USE_SYSTEM_CA set the lock before apply_bunfig_ca_store, and Bun__Node__UseSystemCA is still written on every path.
• All deferred load_config_path(.., RunCommand) sites (run_command.rs ×3, repl_command.rs) call apply_bunfig_ca_store outside the loaded_bunfig guard.
• BunCAStore move to context.rs keeps #[repr(u8)] and the same discriminant order the C++ side reads via Bun__Node__CAStore.
• Bunfig parser branch: invalid values error via add_error_format (non-zero exit), and the top-level CA/ca key doesn't collide with [install].ca.

Extended reasoning...

Overview

Adds a top-level CA = "system" | "openssl" | "bundled" key to bunfig.toml that selects the runtime TLS CA store, equivalent to the existing --use-*-ca CLI flags. Touches: bunfig.rs (parser branch), context.rs (moves BunCAStore enum + adds runtime_options.ca_store), Arguments.rs (precedence block + apply_bunfig_ca_store helper + Bun__Node__CAStore_locked static), three run_command.rs call sites and one repl_command.rs call site (deferred bunfig loads), docs, and tests.

Since my last comment (11:05 UTC), commits 76d5580 and 205cd0c trimmed every multi-line call-site/doc comment to a single line, addressing both my nit and the comment-cop bot's inline warnings. No logic changed.

Security risks

The change routes to one of three CA stores that are already selectable via CLI flags and NODE_USE_SYSTEM_CA; it does not introduce a new trust source or weaken verification. The precedence (CLI > env > bunfig > bundled) means an ambient bunfig.toml cannot override an explicit CLI/env choice — the lock flag is set before apply_bunfig_ca_store runs. The parser rejects unknown values with a hard error rather than silently falling through. I don't see a way this expands the attack surface beyond what the existing flags already permit.

Level of scrutiny

Medium-high. The implementation is mechanical plumbing of an existing capability, but (a) it's a new user-facing config key whose name and value set become permanent API, and (b) it's TLS-adjacent. Per the repo's review guidance on API design and security-sensitive paths, a maintainer should confirm the surface (uppercase CA with lowercase alias, string enum values, documented precedence) is what they want before it ships.

Other factors

This PR has been through several review rounds since May: the missed deferred-load sites (my earlier finding), the non-hermetic test cwd, the openssl parity assertion, the REPL guard placement, and the .zig dual-tracking have all been fixed or mooted by rebase. Test coverage is thorough — the full precedence matrix plus bun run, bun test, and invalid-value paths, verified to fail on baseline. All comment-cop and CodeRabbit threads are resolved. The remaining open item is my own nit thread, which the latest two commits address; nothing substantive is outstanding.

[robobun]

CI for 205cd0c is effectively green: 177 of 179 jobs passed, and the build only reports failed because the two darwin 14 aarch64 test jobs expired waiting for an agent. The two flaky-test warnings (inspect-error-leak timeout, napi test_buffer) passed on retry and are unrelated to this change. Ready for maintainer review.

[anru]

This PR doesn't fix #17108 issue. Bun must take into account NODE_USE_SYSTEM_CA, NODE_TLS_REJECT_UNAUTHORIZED or other net/tls related ENV for network operations.

Bun should take this ENVs into account regardless of the command used. These environment variables should act as runtime-wide environment properties, not just for specific commands.

[anru]

This does not affect bun install's registry client — for that, see install.ca and install.cafile.

This is flawed logic. See here #17325 for why.

[anru]

Ok, @robobun here is additional context for you why this is flawed logic (from issue #17325 ):

As a user who want adopt bun in SDLC - I don't want to commit the certificate itself or the path to it. I want to be able to set a single certificate for all operations performed through bun, like the NODE_EXTRA_CA_CERTS variable for a node. Or in other words, I want to configure my environment, via a variable once, and thus allow all bun commands to work correctly.

Bun must take into account NODE_USE_SYSTEM_CA, NODE_TLS_REJECT_UNAUTHORIZED or other net/tls related ENV for network operations.

Bun should take this ENVs into account regardless of the command used. These environment variables should act as runtime-wide environment properties, not just for specific commands.

I propose to expand the scope of this MR so that the bun actually takes these environmental variables into account at the proper level. In that case this will fix issue #17325

@Jarred-Sumner what do you think about this ?

[anru]

Also, can you reopen issue #17325 ? This issue is not resolved on main branch:

shell session with Bun v1.4.0 (revision 34cbb9a):

buni *1 ❯  NODE_EXTRA_CA_CERTS=/etc/ssl/certs/internal-net.crt NODE_USE_SYSTEM_CA=1 bun install
bun install v1.4.0 (34cbb9a40)
HTTPThread: the CA is invalid
buni *1 ❯ echo $?
1
buni *1 ❯ NODE_EXTRA_CA_CERTS=/etc/ssl/certs/internal-net.crt yarn install --silent --pure-lockfile
(node:15252) Warning: Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification.
(Use `node --trace-warnings ...` to show where the warning was created)
buni *1 ❯ echo $?                                                                                                                                                                                                                        31s
0

yarn install still works in this case.

[robobun]

@anru You are right that this PR does not resolve #17108, and I removed the closing references to #17108 and #17325 from the PR body so they stay open.

The scope here is #30313 only: make the existing CA-store selection configurable in bunfig.toml. The selection mechanism itself is unchanged. Today Bun reads the --use-*-ca flags and NODE_USE_SYSTEM_CA only for runtime commands (bun run, bun test, bun file.ts, and node compat mode). The bun install registry client has its own trust config (install.ca and install.cafile). That split predates this PR.

Making the CA selection apply runtime-wide, including bun install, and honoring more TLS env vars is a real request. It needs its own change and review, and #17108 and #17325 now remain open to track it.