From 02eb2972b4956aeafcb354b486e9cdff421f75be Mon Sep 17 00:00:00 2001
From: Roman Inflianskas <Roman.Inflianskas@amd.com>
Date: Wed, 10 Jun 2026 10:11:39 +0000
Subject: [PATCH] Enable native-certs for ureq across all crates

Switch ureq's TLS from the bundled webpki-roots to the platform's native
certificate store by enabling the `native-certs` feature in every crate that
makes HTTPS requests (rocm, rocmd, rocm-core, lemonade).

This lets downloads succeed in environments that terminate TLS with a custom
root CA or a corporate MITM proxy, where the static webpki root set rejects
the re-signed certificate chain.
---
 Cargo.lock                  | 65 +++++++++++++++++++++++++++++++++++--
 apps/rocm/Cargo.toml        |  2 +-
 apps/rocmd/Cargo.toml       |  2 +-
 crates/rocm-core/Cargo.toml |  2 +-
 engines/lemonade/Cargo.toml |  2 +-
 5 files changed, 67 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2b9cde6e..f405a645 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -98,7 +98,7 @@ checksum = "a7be2f067ccd8d4b4d4a66ddafe0f32a5dff31732f32dbff85fefc40929b1f72"
 dependencies = [
  "keyring-core",
  "log",
- "security-framework",
+ "security-framework 3.7.0",
 ]
 
 [[package]]
@@ -507,6 +507,16 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.10.1"
@@ -1476,6 +1486,12 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
+[[package]]
+name = "openssl-probe"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
@@ -1920,6 +1936,28 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-native-certs"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5bfb394eeed242e909609f56089eecfe5fda225042e8b171791b9c95f5931e5"
+dependencies = [
+ "openssl-probe",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework 2.11.1",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "rustls-pki-types"
 version = "1.14.1"
@@ -1952,6 +1990,15 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -1977,6 +2024,19 @@ dependencies = [
  "zbus",
 ]
 
+[[package]]
+name = "security-framework"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -1984,7 +2044,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
  "bitflags",
- "core-foundation",
+ "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
  "security-framework-sys",
@@ -2500,6 +2560,7 @@ dependencies = [
  "log",
  "once_cell",
  "rustls",
+ "rustls-native-certs",
  "rustls-pki-types",
  "serde",
  "serde_json",
diff --git a/apps/rocm/Cargo.toml b/apps/rocm/Cargo.toml
index 3f965ee8..3e37a946 100644
--- a/apps/rocm/Cargo.toml
+++ b/apps/rocm/Cargo.toml
@@ -25,7 +25,7 @@ rpassword.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 tar = "0.4"
-ureq = "2.12"
+ureq = { version = "2.12", features = ["native-certs"] }
 
 [target.'cfg(target_os = "windows")'.dependencies]
 windows-native-keyring-store = "1.1"
diff --git a/apps/rocmd/Cargo.toml b/apps/rocmd/Cargo.toml
index 232a2a80..ea84acae 100644
--- a/apps/rocmd/Cargo.toml
+++ b/apps/rocmd/Cargo.toml
@@ -16,4 +16,4 @@ serde.workspace = true
 serde_json.workspace = true
 sha2 = "0.10"
 tokio.workspace = true
-ureq = "2.12"
+ureq = { version = "2.12", features = ["native-certs"] }
diff --git a/crates/rocm-core/Cargo.toml b/crates/rocm-core/Cargo.toml
index 5739f29f..cae4794d 100644
--- a/crates/rocm-core/Cargo.toml
+++ b/crates/rocm-core/Cargo.toml
@@ -12,7 +12,7 @@ directories.workspace = true
 libc.workspace = true
 serde.workspace = true
 serde_json.workspace = true
-ureq = "2.12"
+ureq = { version = "2.12", features = ["native-certs"] }
 
 [target.'cfg(target_os = "windows")'.dependencies]
 windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_Security", "Win32_System_Registry", "Win32_System_SystemInformation", "Win32_System_Threading"] }
diff --git a/engines/lemonade/Cargo.toml b/engines/lemonade/Cargo.toml
index 4aad050f..4e35b806 100644
--- a/engines/lemonade/Cargo.toml
+++ b/engines/lemonade/Cargo.toml
@@ -17,4 +17,4 @@ rocm-core = { path = "../../crates/rocm-core" }
 rocm-engine-protocol = { path = "../../crates/rocm-engine-protocol" }
 serde.workspace = true
 serde_json.workspace = true
-ureq = { version = "2.12", features = ["json"] }
+ureq = { version = "2.12", features = ["json", "native-certs"] }