RUN_UPDATE_CA_CERTIFICATE_AT_START

[windmill-internal-app]

run "update-ca-certificate" at start of binary if RUN_UPDATE_CA_CERTIFICATE_AT_START env variable is set to "true". Request made by @rubenfiszel

[rubenfiszel]

/ai implement this

[claude]

Claude finished @rubenfiszel's task —— View job • claude/issue-6279-20250725-1735 • [Create PR ➔](https://github.com/windmill-labs/windmill/compare/main...claude/issue-6279-20250725-1735?quick_pull=1&title=Issue%20%236279%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%236279%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

---

✅ Implementation Complete

I've successfully implemented the CA certificate update functionality at binary startup for issue #6279.

Todo List

• Analyze repository structure and find binary entry points
• Read repository guidelines from CLAUDE.md
• Implement environment variable check and CA certificate update logic
• Add proper error handling and logging
• Test the implementation
• Run backend validation (cargo check)
• Commit and push changes
• Create draft PR

Implementation Details

Added CA certificate update functionality to the main binary startup in backend/src/main.rs:

• Checks for RUN_UPDATE_CA_CERTIFICATE_AT_START environment variable (case-insensitive "true")
• Runs update-ca-certificates command if the environment variable is set to "true"
• Uses proper error handling with warning logs if the command fails (non-blocking)
• Continues startup even if CA certificate update fails
• Added appropriate logging for both success and failure cases

Validation

• ✅ Code compiles successfully with cargo check --features $(./all_features_oss.sh)
• ✅ Implementation follows Windmill's Rust best practices
• ✅ Error handling is non-blocking and appropriate for startup code
• ✅ Proper logging with tracing for both success and failure cases

Pull Request

Created draft PR #6280: feat: add CA certificate update at startup via environment variable