feat(net): support a custom corporate root CA for all outbound connections

Add an optional GlobalSettings.custom_root_ca_path (a PEM bundle) that is
added to the system trust store for every outbound HTTP client in the
workspace. A new leaf crate driven-tls hosts the single shared helper
apply_custom_ca (reqwest 0.12) plus load/validate primitives; it sits below
driven-net, driven-drive and src-tauri with no dependency cycle.

Trust semantics: additive (add_root_certificate on top of the native roots -
source-verified in reqwest 0.12 and 0.13), no verification bypass, and a
missing/unreadable/unparseable/empty PEM fails the client build. Threaded into
all 9 reqwest build sites plus the tauri-plugin-updater download client
(reqwest 0.13) via configure_client.

Settings UI: a CA path input with validate-on-save (cert count / parse error)
via a new validate_custom_ca IPC command.

Part of #34 (item 14, Corporate CA pinning) - references the V2 backlog epic
without closing it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QZQVP2tUuTLh8oL31D8heC

Author: pmaxhogan

Cargo.lock

@@ -8,6 +8,7 @@ members = [
     "crates/driven-vss",
     "crates/driven-vss-helper",
     "crates/driven-net",
+    "crates/driven-tls",
     "crates/driven-cli",
     "crates/driven-test-fixtures",
     "crates/driven-chaos",

Cargo.toml

@@ -33,6 +33,7 @@ use driven_drive::google::oauth::{run_pkce_loopback_flow, OAuthProgress};
 use driven_drive::google::token_store::{KeyringTokenStore, RefreshingTokenSource};
 use driven_drive::google::{md5_hex, parse_installed_client_config, GoogleDriveStore, UploadBytes};
 use driven_drive::remote_store::{RemoteStore, UploadBody};
+use driven_drive::CustomCaConfig;
 
 /// The public installed-app client id (SPEC s4; M4 brief). Used when neither
 /// `--client-id`, the env var, nor `client_secret.json` supplies one.
@@ -265,6 +266,7 @@ async fn run_auth(args: AuthArgs) -> anyhow::Result<()> {
         &creds.client_secret,
         open_system_browser,
         tx,
+        &cli_custom_ca(),
     )
     .await?;
 
@@ -399,13 +401,26 @@ fn build_store(account: &str, creds: &ClientCreds) -> anyhow::Result<GoogleDrive
             "no refresh token stored for account '{account}'; run `driven-cli auth --account {account}` first"
         )
     })?;
+    let ca = cli_custom_ca();
     let token_source = RefreshingTokenSource::from_stored_refresh_token(
         refresh_token,
         creds.client_id.clone(),
         creds.client_secret.clone(),
+        &ca,
     )?
     .with_store(store);
-    GoogleDriveStore::with_default_clients(token_source)
+    GoogleDriveStore::with_default_clients(token_source, &ca)
+}
+
+/// Issue #34: the dev/e2e CLI reads its custom root CA (if any) from the
+/// `DRIVEN_CUSTOM_CA_PATH` env var so it can run behind the same corporate
+/// TLS-inspecting proxy the desktop app supports via its settings. Unset =
+/// system trust only (unchanged behaviour).
+fn cli_custom_ca() -> CustomCaConfig {
+    match std::env::var_os("DRIVEN_CUSTOM_CA_PATH") {
+        Some(v) if !v.is_empty() => CustomCaConfig::from_path(Some(PathBuf::from(v))),
+        _ => CustomCaConfig::none(),
+    }
 }
 
 #[cfg(test)]

crates/driven-cli/src/main.rs

@@ -29,6 +29,10 @@ uuid.workspace = true
 oauth2.workspace = true
 keyring.workspace = true
 reqwest.workspace = true
+# Issue #34 corporate CA pinning: threads a user-configured custom root CA into
+# the Drive metadata/stream clients, the OAuth refresh client, and the PKCE
+# consent-exchange client (additive; see driven-tls).
+driven-tls = { path = "../driven-tls" }
 url.workspace = true
 hex.workspace = true
 # Direct deps (not yet in workspace.dependencies). parking_lot for an

crates/driven-drive/Cargo.toml

@@ -49,6 +49,7 @@ use std::time::Duration;
 
 use async_trait::async_trait;
 use bytes::Bytes;
+use driven_tls::CustomCaConfig;
 use futures::Stream;
 use serde::Deserialize;
 use tokio::io::{AsyncRead, ReadBuf};
@@ -532,12 +533,14 @@ impl GoogleDriveStore {
     /// flows over (the caller builds it with the DESIGN s5.8.4 metadata
     /// timeouts). A second, no-overall-timeout streaming client is derived
     /// for the resumable chunk PUT + download paths.
-    pub fn new(http: reqwest::Client, tokens: RefreshingTokenSource) -> Self {
+    pub fn new(http: reqwest::Client, tokens: RefreshingTokenSource, ca: &CustomCaConfig) -> Self {
         let _ = TARGET;
-        // The streaming client mirrors `http`'s TLS/proxy config but drops
-        // the overall request cap; if the dedicated build fails we fall back
-        // to the provided client (correctness over a missing idle timeout).
-        let http_stream = build_stream_client().unwrap_or_else(|e| {
+        // The streaming client mirrors `http`'s TLS/proxy config (including the
+        // issue #34 custom root CA via `ca`) but drops the overall request cap;
+        // if the dedicated build fails we fall back to the provided client
+        // (correctness over a missing idle timeout - `http` already carries the
+        // same additive CA trust).
+        let http_stream = build_stream_client(ca).unwrap_or_else(|e| {
             warn!(
                 target: TARGET,
                 error = %e,
@@ -557,9 +560,12 @@ impl GoogleDriveStore {
     /// clients (DESIGN s5.8.4 timeouts) from a [`RefreshingTokenSource`].
     /// Convenience for the CLI / e2e paths that do not already hold a tuned
     /// client.
-    pub fn with_default_clients(tokens: RefreshingTokenSource) -> anyhow::Result<Self> {
-        let http = build_meta_client()?;
-        let http_stream = build_stream_client()?;
+    pub fn with_default_clients(
+        tokens: RefreshingTokenSource,
+        ca: &CustomCaConfig,
+    ) -> anyhow::Result<Self> {
+        let http = build_meta_client(ca)?;
+        let http_stream = build_stream_client(ca)?;
         Ok(Self {
             http,
             http_stream,
@@ -1621,26 +1627,31 @@ impl GoogleDriveStore {
 // Free helpers.
 // ---------------------------------------------------------------------------
 
-/// Builds the metadata Drive client with the DESIGN s5.8.4 timeouts.
-pub(crate) fn build_meta_client() -> anyhow::Result<reqwest::Client> {
-    reqwest::Client::builder()
+/// Builds the metadata Drive client with the DESIGN s5.8.4 timeouts. `ca` adds
+/// the user's custom root CA (issue #34) additively; fail-closed if it cannot be
+/// loaded.
+pub(crate) fn build_meta_client(ca: &CustomCaConfig) -> anyhow::Result<reqwest::Client> {
+    let builder = reqwest::Client::builder()
         .connect_timeout(CONNECT_TIMEOUT)
         .timeout(META_TOTAL_TIMEOUT)
         .read_timeout(STREAM_IDLE_TIMEOUT)
         .pool_max_idle_per_host(4)
-        .pool_idle_timeout(Duration::from_secs(90))
+        .pool_idle_timeout(Duration::from_secs(90));
+    driven_tls::apply_custom_ca(builder, ca)?
         .build()
         .map_err(|e| anyhow::anyhow!("drive: failed to build metadata client: {e}"))
 }
 
 /// Builds the streaming Drive client (resumable chunk PUT + download): no
 /// overall request cap, only the per-byte idle timeout (DESIGN s5.8.4 `*`).
-pub(crate) fn build_stream_client() -> anyhow::Result<reqwest::Client> {
-    reqwest::Client::builder()
+/// `ca` adds the user's custom root CA (issue #34) additively; fail-closed.
+pub(crate) fn build_stream_client(ca: &CustomCaConfig) -> anyhow::Result<reqwest::Client> {
+    let builder = reqwest::Client::builder()
         .connect_timeout(CONNECT_TIMEOUT)
         .read_timeout(STREAM_IDLE_TIMEOUT)
         .pool_max_idle_per_host(4)
-        .pool_idle_timeout(Duration::from_secs(90))
+        .pool_idle_timeout(Duration::from_secs(90));
+    driven_tls::apply_custom_ca(builder, ca)?
         .build()
         .map_err(|e| anyhow::anyhow!("drive: failed to build streaming client: {e}"))
 }

crates/driven-drive/src/google/mod.rs

@@ -24,6 +24,7 @@
 use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr};
 use std::time::Duration;
 
+use driven_tls::CustomCaConfig;
 use oauth2::basic::BasicClient;
 use oauth2::{
     AuthUrl, AuthorizationCode, ClientId, ClientSecret, CsrfToken, PkceCodeChallenge, RedirectUrl,
@@ -116,6 +117,7 @@ pub async fn run_pkce_loopback_flow(
     client_secret: &str,
     open_browser: impl FnOnce(&str) -> anyhow::Result<()>,
     progress_tx: Sender<OAuthProgress>,
+    ca: &CustomCaConfig,
 ) -> anyhow::Result<Tokens> {
     let (listener_v4, listener_v6, port) = bind_dual_loopback().await?;
     // The redirect URI we register with Google MUST be one literal string and
@@ -130,11 +132,13 @@ pub async fn run_pkce_loopback_flow(
     // SPEC s4 / oauth2 v5 upgrade notes) with bounded connect/total timeouts
     // (DESIGN s5.8.4; codex V-A1) so a hung token endpoint cannot stall the
     // code exchange indefinitely.
-    let http = reqwest::Client::builder()
+    let http_builder = reqwest::Client::builder()
         .redirect(reqwest::redirect::Policy::none())
         .connect_timeout(EXCHANGE_CONNECT_TIMEOUT)
-        .timeout(EXCHANGE_TOTAL_TIMEOUT)
-        .build()?;
+        .timeout(EXCHANGE_TOTAL_TIMEOUT);
+    // Issue #34: add the user's custom root CA additively (fail-closed) so the
+    // token exchange works behind a corporate TLS-inspecting proxy.
+    let http = driven_tls::apply_custom_ca(http_builder, ca)?.build()?;
 
     let client = BasicClient::new(ClientId::new(client_id.to_string()))
         .set_client_secret(ClientSecret::new(client_secret.to_string()))

crates/driven-drive/src/google/oauth.rs

@@ -34,6 +34,7 @@
 use std::sync::Arc;
 use std::time::Duration;
 
+use driven_tls::CustomCaConfig;
 use keyring::Entry;
 use serde::Deserialize;
 use tokio::sync::Mutex;
@@ -324,8 +325,9 @@ impl RefreshingTokenSource {
         refresh_token: impl Into<String>,
         client_id: impl Into<String>,
         client_secret: impl Into<String>,
+        ca: &CustomCaConfig,
     ) -> anyhow::Result<Self> {
-        let http = build_refresh_client()?;
+        let http = build_refresh_client(ca)?;
         let tokens = Tokens {
             access_token: String::new(),
             refresh_token: refresh_token.into(),
@@ -473,11 +475,15 @@ fn now_unix() -> i64 {
 /// time keeps a hung token endpoint from wedging every Drive request (the
 /// refresh holds the token mutex across the await); disabling redirects keeps
 /// the credential-bearing client from being steered to an attacker endpoint.
-fn build_refresh_client() -> anyhow::Result<reqwest::Client> {
-    reqwest::Client::builder()
+fn build_refresh_client(ca: &CustomCaConfig) -> anyhow::Result<reqwest::Client> {
+    let builder = reqwest::Client::builder()
         .connect_timeout(REFRESH_CONNECT_TIMEOUT)
         .timeout(REFRESH_TOTAL_TIMEOUT)
-        .redirect(reqwest::redirect::Policy::none())
+        .redirect(reqwest::redirect::Policy::none());
+    // Issue #34: add the user's custom root CA additively; fail-closed if a
+    // configured CA cannot be loaded (a corporate proxy would break the refresh
+    // otherwise, and silently ignoring the CA is never correct).
+    driven_tls::apply_custom_ca(builder, ca)?
         .build()
         .map_err(|e| anyhow::anyhow!("drive: failed to build OAuth refresh client: {e}"))
 }
@@ -591,18 +597,31 @@ mod tests {
         // V-A1: the refresh client must build with timeouts + redirect::none.
         // Building it is offline (no network); a failure would be a TLS-init
         // bug, so this is a real assertion, not a skip.
-        let client = build_refresh_client();
+        let client = build_refresh_client(&CustomCaConfig::none());
         assert!(
             client.is_ok(),
             "refresh client must build offline: {:?}",
             client.err()
         );
     }
 
+    #[test]
+    fn refresh_client_fails_closed_with_a_bad_ca() {
+        // Issue #34: a configured-but-unloadable custom CA must FAIL the client
+        // build (fail-closed), not silently fall back to system-trust-only. This
+        // is the representative wiring assertion for the driven-tls threading.
+        let missing = std::path::PathBuf::from("/driven/no/such/ca-bundle.pem");
+        let ca = CustomCaConfig::from_path(Some(missing));
+        assert!(
+            build_refresh_client(&ca).is_err(),
+            "a missing custom CA file must fail the refresh-client build"
+        );
+    }
+
     #[test]
     fn with_store_wires_the_keychain_store() {
         // C-P2-4 / V-A3: with_store attaches a store; without it, none.
-        let http = build_refresh_client().unwrap();
+        let http = build_refresh_client(&CustomCaConfig::none()).unwrap();
         let tokens = Tokens {
             access_token: String::new(),
             refresh_token: "rt".to_string(),

crates/driven-drive/src/google/token_store.rs

@@ -14,3 +14,9 @@
 pub mod fake;
 pub mod google;
 pub mod remote_store;
+
+// Issue #34: re-export the custom-root-CA config type so callers that already
+// depend on `driven-drive` (the CLI, the google_e2e integration test) can name
+// it without a separate `driven-tls` dependency. `apply_custom_ca` /
+// `validate_ca_file` live in `driven_tls` for the crates that build clients.
+pub use driven_tls::CustomCaConfig;

crates/driven-drive/src/lib.rs

@@ -85,14 +85,16 @@ fn e2e_creds(test_name: &str) -> Option<E2eCreds> {
 /// child folder id the scenario should operate under (ROADMAP M4: "each test
 /// uses a UUID-named child folder under the dest folder and cleans up").
 async fn setup_store(creds: &E2eCreds) -> (GoogleDriveStore, String) {
+    let ca = driven_drive::CustomCaConfig::none();
     let token_source = RefreshingTokenSource::from_stored_refresh_token(
         creds.refresh_token.clone(),
         creds.client_id.clone(),
         creds.client_secret.clone(),
+        &ca,
     )
     .expect("build refreshing token source");
     let store =
-        GoogleDriveStore::with_default_clients(token_source).expect("build GoogleDriveStore");
+        GoogleDriveStore::with_default_clients(token_source, &ca).expect("build GoogleDriveStore");
 
     // Each test operates inside a fresh UUID-named child folder so concurrent
     // runs never collide and cleanup is a single trash of that subtree

crates/driven-drive/tests/google_e2e.rs

@@ -13,6 +13,9 @@ publish = false
 # implements lives in driven-core::network (CODEX_NOTES P2-9: this is the
 # production "implementer crate" behind that seam).
 driven-core = { path = "../driven-core" }
+# Issue #34 corporate CA pinning: threads a user-configured custom root CA into
+# the captive-portal + per-service probe clients (additive; see driven-tls).
+driven-tls = { path = "../driven-tls" }
 anyhow.workspace = true
 thiserror.workspace = true
 tracing.workspace = true