From 746279fa03561f648d3ee72aa931858541a7ffed Mon Sep 17 00:00:00 2001
From: Tunglies <77394545+Tunglies@users.noreply.github.com>
Date: Tue, 26 May 2026 00:13:13 +0800
Subject: [PATCH] refactor: remove subscription TLS roots fallback

---
 Changelog.md                   |   7 +++
 src-tauri/src/utils/network.rs | 105 +++------------------------------
 2 files changed, 15 insertions(+), 97 deletions(-)

diff --git a/Changelog.md b/Changelog.md
index da2b2f17f..9fdca6a50 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -14,6 +14,13 @@
 
 </details>
 
+<details>
+<summary><strong> 🧹 移除变更 </strong></summary>
+
+- 移除订阅下载 TLS 校验失败后的静态根证书回退重试
+
+</details>
+
 <details>
 <summary><strong> 🚀 优化改进 </strong></summary>
 
diff --git a/src-tauri/src/utils/network.rs b/src-tauri/src/utils/network.rs
index e9463cc99..37a9011e7 100644
--- a/src-tauri/src/utils/network.rs
+++ b/src-tauri/src/utils/network.rs
@@ -6,7 +6,7 @@ use reqwest::{
     header::{HeaderMap, HeaderValue, USER_AGENT},
 };
 use smartstring::alias::String;
-use std::{sync::Arc, time::Duration};
+use std::time::Duration;
 use sysproxy::Sysproxy;
 use tauri::Url;
 
@@ -42,12 +42,6 @@ pub enum ProxyType {
     System,
 }
 
-#[derive(Debug, Clone, Copy)]
-enum TlsRootMode {
-    PlatformVerifier,
-    StaticWebpkiRoots,
-}
-
 pub struct NetworkManager;
 
 impl Default for NetworkManager {
@@ -67,7 +61,6 @@ impl NetworkManager {
         default_headers: HeaderMap,
         accept_invalid_certs: bool,
         timeout_secs: Option<u64>,
-        tls_root_mode: TlsRootMode,
     ) -> Result<Client> {
         let mut builder = Client::builder()
             .tls_backend_rustls()
@@ -76,10 +69,6 @@ impl NetworkManager {
             .pool_max_idle_per_host(0)
             .pool_idle_timeout(None);
 
-        if matches!(tls_root_mode, TlsRootMode::StaticWebpkiRoots) {
-            builder = builder.tls_backend_preconfigured(Self::build_static_webpki_tls_config()?);
-        }
-
         // 设置代理
         if let Some(proxy_str) = proxy_url {
             let proxy = Proxy::all(proxy_str)?;
@@ -107,44 +96,6 @@ impl NetworkManager {
         Ok(builder.build()?)
     }
 
-    fn build_static_webpki_tls_config() -> Result<rustls::ClientConfig> {
-        let root_store = rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
-        let mut config =
-            rustls::ClientConfig::builder_with_provider(Arc::new(rustls::crypto::ring::default_provider()))
-                .with_safe_default_protocol_versions()?
-                .with_root_certificates(root_store)
-                .with_no_client_auth();
-
-        config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
-
-        Ok(config)
-    }
-
-    fn should_retry_with_static_webpki_roots(err: &anyhow::Error) -> bool {
-        if err.chain().any(Self::is_legacy_tls_protocol_error) {
-            return false;
-        }
-
-        err.chain().any(|e| {
-            let msg = e.to_string().to_ascii_lowercase();
-            [
-                "certificate",
-                "cert",
-                "tls",
-                "ssl",
-                "rustls",
-                "webpki",
-                "revocation",
-                "ocsp",
-                "crl",
-                "issuer",
-                "unknownissuer",
-            ]
-            .iter()
-            .any(|kw| msg.contains(kw))
-        })
-    }
-
     fn context_reqwest_error(err: reqwest::Error, context: &'static str) -> anyhow::Error {
         let legacy_tls = Self::is_legacy_tls_protocol_error(&err);
         let err = anyhow::Error::new(err).context(context);
@@ -168,24 +119,17 @@ impl NetworkManager {
         user_agent: Option<String>,
         accept_invalid_certs: bool,
     ) -> Result<Client> {
-        self.create_request_with_tls_mode(
-            proxy_type,
-            timeout_secs,
-            user_agent,
-            accept_invalid_certs,
-            TlsRootMode::PlatformVerifier,
-        )
-        .await
+        self.create_request_with_tls_mode(proxy_type, timeout_secs, user_agent, accept_invalid_certs)
+            .await
     }
 
-    async fn get_with_tls_mode(
+    async fn get(
         &self,
         url: &str,
         proxy_type: ProxyType,
         timeout_secs: Option<u64>,
         user_agent: Option<String>,
         accept_invalid_certs: bool,
-        tls_root_mode: TlsRootMode,
     ) -> Result<HttpResponse> {
         let mut parsed = Url::parse(url)?;
         let mut extra_headers = HeaderMap::new();
@@ -207,13 +151,7 @@ impl NetworkManager {
 
         // 创建请求
         let client = self
-            .create_request_with_tls_mode(
-                proxy_type,
-                timeout_secs,
-                user_agent,
-                accept_invalid_certs,
-                tls_root_mode,
-            )
+            .create_request_with_tls_mode(proxy_type, timeout_secs, user_agent, accept_invalid_certs)
             .await?;
 
         let mut request_builder = client.get(parsed);
@@ -247,7 +185,6 @@ impl NetworkManager {
         timeout_secs: Option<u64>,
         user_agent: Option<String>,
         accept_invalid_certs: bool,
-        tls_root_mode: TlsRootMode,
     ) -> Result<Client> {
         let proxy_url: Option<std::string::String> = match proxy_type {
             ProxyType::None => None,
@@ -282,7 +219,7 @@ impl NetworkManager {
             );
         }
 
-        self.build_client(proxy_url, headers, accept_invalid_certs, timeout_secs, tls_root_mode)
+        self.build_client(proxy_url, headers, accept_invalid_certs, timeout_secs)
     }
 
     pub async fn get_with_interrupt(
@@ -293,33 +230,7 @@ impl NetworkManager {
         user_agent: Option<String>,
         accept_invalid_certs: bool,
     ) -> Result<HttpResponse> {
-        let platform_result = self
-            .get_with_tls_mode(
-                url,
-                proxy_type,
-                timeout_secs,
-                user_agent.clone(),
-                accept_invalid_certs,
-                TlsRootMode::PlatformVerifier,
-            )
-            .await;
-
-        match platform_result {
-            Ok(response) => Ok(response),
-            Err(err) if !accept_invalid_certs && Self::should_retry_with_static_webpki_roots(&err) => self
-                .get_with_tls_mode(
-                    url,
-                    proxy_type,
-                    timeout_secs,
-                    user_agent,
-                    accept_invalid_certs,
-                    TlsRootMode::StaticWebpkiRoots,
-                )
-                .await
-                .map_err(|fallback_err| {
-                    fallback_err.context("static webpki roots fallback failed after platform TLS verifier failed")
-                }),
-            Err(err) => Err(err),
-        }
+        self.get(url, proxy_type, timeout_secs, user_agent, accept_invalid_certs)
+            .await
     }
 }