feat(parameters): fix android ssl certificate issue by fedpre · Pull Request #3061 · ProvableHQ/snarkVM

fedpre · 2025-12-11T14:42:47Z

Motivation

Android doesn't allow native code to check the system ssl certificate. This PR allows the certificate to be embedded at compile time and avoid the issue on Android.
This is needed on the mobile-sdk as we use curl-sys to download proving keys when doing local proving.

One of my concerns is downloading the certifcate each time. We could store it securely somewhere ourselves and then store the SHA-256 checksum so we can compute the checksum each time and make sure the file is the same and it has not being tempered with.

Test Plan

If you changed any code, please provide us with clear instructions on how you verified your changes work. Bonus points for screenshots and videos!

Documentation

If this PR adds or changes functionality, consider clarifying which docs need to be updated, e.g. on AleoNet/welcome.

Backwards compatibility

Please review backwards compatibility. Does any functionality need to be guarded by an existing or new ConsensusVersion?

… support

…es, including base64, h2, http, hyper, and reqwest with version updates

…ing to a file instead of generating a Rust module

…ca_bundle

…e for curl compatibility

… in unsafe block

…irectory and using curl's cainfo() method

…e file

…g fallback to temp directory

…for direct memory access and adding fallback to file writing

…ndroid for mobile platforms

Copilot

Pull request overview

This PR addresses SSL certificate verification issues on Android and iOS by embedding Mozilla's CA certificate bundle at compile time. The solution downloads the CA bundle during the build process for mobile platforms and configures curl to use it directly from memory, avoiding filesystem access issues that Android's security model restricts.

Key Changes

Adds a build script that downloads Mozilla's CA certificate bundle for Android/iOS builds
Modifies curl configuration to use embedded certificates via ssl_cainfo_blob API
Introduces reqwest 0.11 as a build-time dependency for downloading the CA bundle

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 9 comments.

File	Description
parameters/build.rs	New build script that downloads CA certificate bundle for mobile platforms and writes it to OUT_DIR
parameters/src/macros.rs	Adds platform-specific SSL configuration to use embedded CA bundle on Android/iOS with fallback logic
parameters/Cargo.toml	Adds reqwest 0.11 as build dependency with blocking and rustls-tls features
Cargo.lock	Adds reqwest 0.11.27 and its transitive dependencies to the lock file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

parameters/build.rs

Copilot · 2025-12-17T00:54:40Z

parameters/build.rs

+        let ca_bundle_url = "https://curl.se/ca/cacert.pem";
+        match download_ca_bundle(ca_bundle_url) {
+            Ok(contents) => {
+                // Write the CA bundle as a binary file that can be included with include_bytes!
+                // This is simpler and more efficient than generating a Rust array
+                fs::write(&ca_bundle_path, &contents).expect("Failed to write CA certificate bundle");


The CA bundle is downloaded from an external source (https://curl.se/ca/cacert.pem) without any integrity verification (e.g., checksum validation). This creates a security risk where the build process could be compromised if the downloaded bundle is tampered with or if there's a man-in-the-middle attack during the build.

Consider adding checksum verification for the downloaded CA bundle to ensure integrity. You could:

Store the expected SHA-256 checksum of the bundle in the code or a configuration file

Verify the checksum after download

Update the checksum when intentionally updating to a newer bundle version

This is particularly important since this code is handling SSL/TLS certificates that form the foundation of secure communications.

parameters/src/macros.rs

Copilot · 2025-12-17T00:54:40Z

parameters/build.rs

+    // Download CA bundle for mobile platforms (Android and iOS)
+    let target = env::var("TARGET").unwrap_or_default();
+    if target.contains("android") || target.contains("ios") {
+        let platform = if target.contains("android") { "Android" } else { "iOS" };
+        // Download Mozilla's CA certificate bundle
+        println!("cargo:warning=Downloading CA certificate bundle for {platform}...");
+
+        let ca_bundle_url = "https://curl.se/ca/cacert.pem";
+        match download_ca_bundle(ca_bundle_url) {
+            Ok(contents) => {
+                // Write the CA bundle as a binary file that can be included with include_bytes!
+                // This is simpler and more efficient than generating a Rust array
+                fs::write(&ca_bundle_path, &contents).expect("Failed to write CA certificate bundle");
+
+                println!("cargo:warning=CA certificate bundle downloaded successfully");
+                println!("cargo:rerun-if-changed=build.rs");
+            }
+            Err(e) => {
+                panic!(
+                    "Failed to download CA certificate bundle: {e}\n\
+                     You may need to download it manually from {ca_bundle_url} and place it at {ca_bundle_path:?}"
+                );
+            }
+        }


The build script downloads the CA bundle during every build for mobile platforms. This is inefficient and creates several issues:

Build reliability: Builds will fail if https://curl.se is unavailable or experiencing network issues

Build performance: Every clean build downloads ~200KB unnecessarily

Reproducibility: Different builds could get different versions of the CA bundle if it's updated on the server

Consider adding a mechanism to cache the downloaded bundle and only re-download when necessary (e.g., based on a version number or when explicitly requested). Alternatively, the CA bundle could be vendored in the repository with a separate script to update it when needed, ensuring deterministic builds.

parameters/src/macros.rs

…and macros. Ensure CA bundle is downloaded only for mobile targets and handle errors more gracefully.

iamalwaysuncomfortable · 2026-02-27T19:09:51Z

parameters/src/macros.rs

+            // On mobile platforms (Android and iOS), configure curl to use the bundled CA certificate bundle
+            #[cfg(any(target_os = "android", target_os = "ios"))]
+            {
+                const CA_BUNDLE: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/cacert.pem"));


This isn't a flexible approach. It requires ANYONE building mobile to store a .pem cert with their bundle. If this is going to make it to the protocol level, we should attempt to ensure an arbitrary user of the protocol can use it without specialized knowledge like this.

For now though, this isn't the solution. What we need to do use the iOS/Android native roots of trust, packaging our own is inflexible/redundant. rustls_platform_verifier can help with fetching native roots of trust, but the latest versions of reqwest seem to use this by default, so perhaps we can simply get away with using reqwest to make these calls when android/ios is used.

@fedpre can you make this change to use reqwest and see if it works on iOS/android? If a simple switch of libaries takes care of this, this is a far better option.

@copilot code review[agent] can you verify that using reqwest instead of curl could be a potential solution here (due to its usage of rustls_platform_verifier?

I'm not a mobile expert, but this makes a lot of sense to me, thank you @iamalwaysuncomfortable . @fedpre keen to hear if using reqwest is a practical way to resolve the issue, happy to set up a call if we need to iterate more.

I can't trigger copilot but ChatGPT-5.2 agrees, though it notes the platform verifier is only enabled by default from reqwest 0.13

The problem is that snarkvm-parameters uses curl when fetching the parameters for local proving. Here is the Cargo.toml in snarkvm-parameters:

[target.'cfg(all(not(target_family = "wasm"), not(target_env = "sgx")))'.dependencies.curl] version = "0.4.43"

As we are not using wasm, we default curl. Hence, my workaround because iOS works fine but Android fails. I think the change needs to happen there and instead of using curl we use reqwest? Is it what we are talking about here? Just wanted to understand better your comment and implement the right solution. I'd love to have a call and go through this together for sure.

I will go ahead and test the implementation here fedpre#2 and if successful I will open a PR. Closing this one for now as this is not the way we want to move forward with it

Opened a new PR after testing the change successfuly #3169

fedpre added 14 commits December 11, 2025 11:06

feat(parameters): disable default features for curl and enable rustls…

3009ed5

… support

updated cargo.ock

a53df8f

reverted change

96321c4

test for embedding cacert for android

6c5d490

chore: update Cargo.lock to remove unused dependencies and add new on…

76b617a

…es, including base64, h2, http, hyper, and reqwest with version updates

refactor(parameters): simplify CA bundle handling for Android by writ…

6579054

…ing to a file instead of generating a Rust module

fix(parameters): update CA bundle handling to use ca_info instead of …

5794010

…ca_bundle

fix(parameters): update CA bundle handling to use environment variabl…

29d290a

…e for curl compatibility

fix(parameters): wrap environment variable setting for CURL_CA_BUNDLE…

e93e49e

… in unsafe block

refactor(parameters): improve CA bundle handling by writing to aleo d…

e61be38

…irectory and using curl's cainfo() method

fix(parameters): ensure aleo directory exists before writing CA bundl…

8aa5391

…e file

fix(parameters): enhance CA bundle path handling for Android by addin…

a999bab

…g fallback to temp directory

fix(parameters): improve CA bundle handling by using ssl_cainfo_blob …

1742b5b

…for direct memory access and adding fallback to file writing

fix(parameters): extend CA bundle handling to support iOS alongside A…

ef9b7a8

…ndroid for mobile platforms

vicsn requested a review from Copilot December 17, 2025 00:50

Copilot started reviewing on behalf of vicsn December 17, 2025 00:50 View session

Copilot AI reviewed Dec 17, 2025

View reviewed changes

fedpre added 2 commits February 26, 2026 11:39

Merge branch 'staging' into update-curl-dep

045dd11

Update copyright year and improve CA bundle handling in build script …

dd915bd

…and macros. Ensure CA bundle is downloaded only for mobile targets and handle errors more gracefully.

iamalwaysuncomfortable requested changes Feb 27, 2026

View reviewed changes

Merge branch 'staging' into update-curl-dep

1732872

fedpre closed this Mar 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(parameters): fix android ssl certificate issue#3061

feat(parameters): fix android ssl certificate issue#3061
fedpre wants to merge 17 commits intoProvableHQ:stagingfrom
fedpre:update-curl-dep

fedpre commented Dec 11, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Uh oh!

Copilot AI Dec 17, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

iamalwaysuncomfortable Feb 27, 2026

Uh oh!

vicsn Mar 2, 2026 •

edited

Loading

Uh oh!

fedpre Mar 2, 2026 •

edited

Loading

Uh oh!

fedpre Mar 2, 2026

Uh oh!

fedpre Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

fedpre commented Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Test Plan

Documentation

Backwards compatibility

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

iamalwaysuncomfortable Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

vicsn Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fedpre Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fedpre Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

fedpre Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fedpre commented Dec 11, 2025 •

edited

Loading

vicsn Mar 2, 2026 •

edited

Loading

fedpre Mar 2, 2026 •

edited

Loading