fix: trust certificate authorities from the OS certificate store

.github/workflows/release-binaries.yml

@@ -63,7 +63,7 @@ jobs:
 
       - name: Build binary
         run: |
-          bun build src/cli.ts --compile --bytecode --minify --target ${{ matrix.target }} --outfile dist/${{ matrix.artifact }}
+          bun build src/cli.ts --compile --bytecode --compile-exec-argv=--use-system-ca --minify --target ${{ matrix.target }} --outfile dist/${{ matrix.artifact }}
 
       - name: Prepare release asset (Unix)
         if: runner.os != 'Windows'

.github/workflows/smoke-test-linux.yml

@@ -24,7 +24,7 @@ jobs:
       - uses: $/.github/actions/setup-bun-project
 
       - name: Build Linux binary
-        run: bun build src/cli.ts --compile --bytecode --outfile dist/archgate-smoke-test
+        run: bun build src/cli.ts --compile --bytecode --compile-exec-argv=--use-system-ca --outfile dist/archgate-smoke-test
 
       - name: Smoke test binary
         run: |

.github/workflows/smoke-test-windows.yml

@@ -47,7 +47,7 @@ jobs:
           retention-days: 1
 
       - name: Build Windows binary
-        run: bun build src/cli.ts --compile --bytecode --outfile dist/archgate-smoke-test
+        run: bun build src/cli.ts --compile --bytecode --compile-exec-argv=--use-system-ca --outfile dist/archgate-smoke-test
 
       - name: Smoke test binary
         shell: pwsh

docs/public/llms-full.txt

@@ -4777,7 +4777,9 @@ Run `archgate check` to validate your project against its ADRs.
 
 ### TLS/corporate proxy errors
 
-If `archgate login` fails with a TLS certificate error (common behind corporate proxies), point your runtime at your organization's CA bundle using the `NODE_EXTRA_CA_CERTS` environment variable.
+Archgate trusts the certificate authorities installed in your operating system's certificate store (the Windows certificate store, the macOS Keychain, or the system CA bundle on Linux), so a corporate CA that performs TLS inspection works once your IT team has installed it there.
+
+If `archgate login` still fails with a TLS certificate error (common behind corporate proxies), the CA is not in the system store. Install it there, or point Archgate at your organization's CA bundle using the `NODE_EXTRA_CA_CERTS` environment variable.
 
 On macOS/Linux:
 

docs/src/content/docs/nb/reference/cli/login.mdx

@@ -62,7 +62,9 @@ Run `archgate check` to validate your project against its ADRs.
 
 ### TLS/bedriftsproxy-feil
 
-Hvis `archgate login` feiler med en TLS-sertifikatfeil (vanlig bak bedriftsproxyer), pek kjøretidsmiljøet mot organisasjonens CA-sertifikatpakke ved å bruke miljøvariabelen `NODE_EXTRA_CA_CERTS`.
+Archgate stoler på sertifikatutstederne som er installert i operativsystemets sertifikatlager (Windows-sertifikatlageret, macOS-nøkkelringen eller systemets CA-pakke på Linux), så en bedrifts-CA som utfører TLS-inspeksjon fungerer når IT-avdelingen har installert den der.
+
+Hvis `archgate login` fortsatt feiler med en TLS-sertifikatfeil (vanlig bak bedriftsproxyer), ligger ikke CA-en i systemlageret. Installer den der, eller pek Archgate mot organisasjonens CA-sertifikatpakke ved å bruke miljøvariabelen `NODE_EXTRA_CA_CERTS`.
 
 På macOS/Linux:
 

docs/src/content/docs/pt-br/reference/cli/login.mdx

@@ -62,7 +62,9 @@ Run `archgate check` to validate your project against its ADRs.
 
 ### Erros de TLS/proxy corporativo
 
-Se `archgate login` falhar com um erro de certificado TLS (comum em redes com proxy corporativo), aponte o runtime para o certificado CA da sua organização usando a variável de ambiente `NODE_EXTRA_CA_CERTS`.
+O Archgate confia nas autoridades certificadoras instaladas no repositório de certificados do sistema operacional (o repositório de certificados do Windows, o Keychain do macOS ou o pacote de CAs do sistema no Linux), então uma CA corporativa que faz inspeção TLS funciona assim que a equipe de TI a instala ali.
+
+Se `archgate login` ainda falhar com um erro de certificado TLS (comum em redes com proxy corporativo), a CA não está no repositório do sistema. Instale-a ali ou aponte o Archgate para o certificado CA da sua organização usando a variável de ambiente `NODE_EXTRA_CA_CERTS`.
 
 No macOS/Linux:
 

docs/src/content/docs/reference/cli/login.mdx

@@ -62,7 +62,9 @@ Run `archgate check` to validate your project against its ADRs.
 
 ### TLS/corporate proxy errors
 
-If `archgate login` fails with a TLS certificate error (common behind corporate proxies), point your runtime at your organization's CA bundle using the `NODE_EXTRA_CA_CERTS` environment variable.
+Archgate trusts the certificate authorities installed in your operating system's certificate store (the Windows certificate store, the macOS Keychain, or the system CA bundle on Linux), so a corporate CA that performs TLS inspection works once your IT team has installed it there.
+
+If `archgate login` still fails with a TLS certificate error (common behind corporate proxies), the CA is not in the system store. Install it there, or point Archgate at your organization's CA bundle using the `NODE_EXTRA_CA_CERTS` environment variable.
 
 On macOS/Linux:
 

package.json

@@ -37,7 +37,7 @@
   "type": "module",
   "scripts": {
     "audit": "bun audit --ignore=GHSA-vfj7-8cjw-p6xm",
-    "build:check": "bun build src/cli.ts --compile --bytecode --outfile dist/.build-check && rm -f dist/.build-check dist/.build-check.exe",
+    "build:check": "bun build src/cli.ts --compile --bytecode --compile-exec-argv=--use-system-ca --outfile dist/.build-check && rm -f dist/.build-check dist/.build-check.exe",
     "build:winget": "bun run shims/winget/build.ts",
     "changelog": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",
     "check": "bun run src/cli.ts check",

src/helpers/tls.ts

@@ -44,7 +44,9 @@ export function tlsHintMessage(): string {
     "TLS certificate verification failed.",
     "This typically happens behind a corporate proxy that performs SSL inspection.",
     "",
-    "To fix this, set the NODE_EXTRA_CA_CERTS environment variable to your corporate CA certificate:",
+    "The archgate binary trusts the certificate authorities installed in your operating system's",
+    "certificate store. Ask your IT team to install the corporate CA certificate there,",
+    "or set the NODE_EXTRA_CA_CERTS environment variable to its path:",
     "",
     ...examples,
     "",

tests/helpers/tls.test.ts

@@ -46,6 +46,11 @@ describe("tlsHintMessage", () => {
     expect(tlsHintMessage()).toContain("NODE_EXTRA_CA_CERTS");
   });
 
+  test("mentions the operating system certificate store", () => {
+    expect(tlsHintMessage()).toContain("operating system");
+    expect(tlsHintMessage()).toContain("certificate store");
+  });
+
   test("mentions corporate proxy", () => {
     expect(tlsHintMessage()).toContain("corporate proxy");
   });