The plugin now reads a HARNESS_CA_PATH environment variable pointing to a PEM CA file and installs it into the host system trust store before starting the Docker daemon. This solves x509 errors when builds run behind TLS-intercepting egress proxies that re-sign upstream TLS with their own CA.
- Linux: installs into distro anchor directory (/usr/local/share/ca-certificates or /etc/pki/ca-trust/source/anchors) and refreshes system bundle via update-ca-certificates/update-ca-trust, with direct bundle append fallback
- Windows: imports via certutil -addstore Root
- macOS: logged no-op (not currently supported)
- Best-effort, idempotent, documented in README.md with usage examples
- New platform-specific source files: ca_linux.go, ca_windows.go, ca_other.go
- Comprehensive tests added: ca_test.go, ca_linux_test.go
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
AI-Session-Id: fe2aa5fe-1bf5-4257-ab76-2c862c5637fe
AI-Tool: claude-code
AI-Model: unknown
Raghav