fix(network): trust the core's CA bundle in app requests

Changelog: Downloads no longer fail on missing root certificates

.github/workflows/build.yaml

@@ -419,6 +419,18 @@ jobs:
         if: matrix.platform == 'macos' && matrix.arch == 'amd64'
         run: plutil -replace FLTEnableImpeller -bool NO macos/Runner/Info.plist
 
+      # The core embeds this bundle and FlClashHttpOverrides.trustCoreRoots loads it for Dart.
+      # Pinned by hash, so a new bundle from https://curl.se/docs/caextract.html is a reviewed bump.
+      - name: Fetch CA certificates
+        shell: bash
+        env:
+          CA_BUNDLE: cacert-2026-09-25.pem
+          CA_BUNDLE_SHA256: a41b5d356aea97a529fe27e0f7316d2f9d946d75927476cf9cf1b90637d00505
+        run: |
+          bundle=core/Clash.Meta/component/ca/ca-certificates.crt
+          curl -fsSL --retry 3 -o "$bundle" "https://curl.se/ca/$CA_BUNDLE"
+          echo "$CA_BUNDLE_SHA256  $bundle" | sha256sum -c -
+
       - name: Setup
         env:
           ANDROID_NDK_HOME: ${{ steps.build-ndk.outputs.ndk-path }}

lib/common/http.dart

@@ -5,6 +5,7 @@ import 'package:fl_clash/enum/enum.dart';
 import 'package:fl_clash/models/models.dart';
 import 'package:fl_clash/providers/config.dart';
 import 'package:fl_clash/providers/state.dart';
+import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
 class FlClashHttpOverrides extends HttpOverrides {
@@ -12,6 +13,25 @@ class FlClashHttpOverrides extends HttpOverrides {
 
   FlClashHttpOverrides(this._container);
 
+  static const _coreRootsAsset =
+      'core/Clash.Meta/component/ca/ca-certificates.crt';
+
+  /// The bundle the core embeds; only release CI fills it.
+  static Future<void> trustCoreRoots() async {
+    try {
+      final data = await rootBundle.load(_coreRootsAsset);
+      if (data.lengthInBytes == 0) return;
+      SecurityContext.defaultContext.setTrustedCertificatesBytes(
+        data.buffer.asUint8List(data.offsetInBytes, data.lengthInBytes),
+      );
+    } catch (e) {
+      commonPrint.log(
+        'trustCoreRoots error ${compactError(e)}',
+        logLevel: LogLevel.warning,
+      );
+    }
+  }
+
   static String findProxyFor(ProviderContainer container, Uri url) {
     return findProxyForReader(container.read, url);
   }

lib/main.dart

@@ -39,6 +39,7 @@ void main(List<String> args) {
         await RustLib.init();
         final version = await system.init();
         final container = await bootstrap.init(version);
+        await FlClashHttpOverrides.trustCoreRoots();
         HttpOverrides.global = FlClashHttpOverrides(container);
         request.attach(container.read);
         runApp(

pubspec.yaml

@@ -100,6 +100,7 @@ flutter:
     - assets/images/
     - assets/images/avatar/
     - assets/images/services/
+    - core/Clash.Meta/component/ca/ca-certificates.crt
     - path: assets/images/tray/unix/
       platforms: [ linux ]
     - path: assets/images/tray/macos/