winetricks fails inside pressure-vessel containers (TMPDIR + SSL issues)

[Brensom]

I've been trying to get winetricks working inside pressure-vessel containers (used by umu-launcher and Steam Runtime) on NixOS 26.05, and I'm hitting two separate issues that both prevent any verb from completing. This isn't specific to one game — it breaks the entire workflow for installing Windows dependencies in containerized environments.

The Problems

Problem 1: TMPDIR points to non-existent directory

When running winetricks inside pressure-vessel, the container inherits the host's TMPDIR environment variable but doesn't mount that path. On NixOS, TMPDIR is often set to something like /tmp/nix-shell-XXXXX-0 which doesn't exist inside the container.

Winetricks blindly trusts TMPDIR and crashes:

mktemp: failed to create directory via template '/tmp/nix-shell-XXXXX-0/winetricks.XXXXXXXX': No such file or directory
warning: temporary directory: '' ; does not exist

I know this is related to issue #687 in umu-launcher (which I filed), but the root cause is that winetricks doesn't validate TMPDIR before using it. This should be a simple fix — just check if the directory exists and fall back to /tmp if it doesn't.

Problem 2: SSL certificates not accessible inside container

Even after fixing TMPDIR, any verb that downloads files over HTTPS (vcrun2019, vcrun2022, dotnet45, etc.) fails with:

ERROR: Failed to download https://aka.ms/vc14/vc_redist.x64.exe: 77 / Problem with the SSL CA cert (path? access rights?)

The pressure-vessel container doesn't mount /etc/ssl/certs from the host, and doesn't propagate SSL_CERT_FILE or CURL_CA_BUNDLE environment variables. Wine's libcurl can't verify HTTPS certificates.

I saw that GloriousEggroll hit a similar SSL issue in #2400 (wget fails with GnuTLS in umu on Fedora 42), and the response was that it should be "fixed at the distribution level." But that's not really helpful — winetricks should at least respect SSL_CERT_FILE so users can point to host certificates.

Environment

• OS: NixOS 26.05 (Yarara)
• winetricks: 20260125
• umu-launcher: 1.4.0
• Proton: GE-Proton11-1
• Container: pressure-vessel (steamrt4)

Steps to Reproduce

Case A: TMPDIR failure

# Simulate pressure-vessel behavior
export TMPDIR=/tmp/non-existent-dir-123
winetricks corefonts

Result: mktemp fails immediately.

Case B: SSL failure

# Inside pressure-vessel via umu-launcher
GAMEID=umu-heroesofnewerthreborn \
PROTONPATH=~/.local/share/Steam/compatibilitytools.d/GE-Proton11-1 \
umu-run ./game.exe

Result: Game launcher tries to download vc_redist.x64.exe over HTTPS, fails with curl error 77.

Case C: Manual winetricks in container

export WINEPREFIX=~/Games/umu/umu-heroesofnewerthreborn/pfx
steam-run winetricks vcrun2019

Result: Winetricks downloads the installer on the host, but the MSVC installer inside Wine fails with the same SSL error.

Expected Behavior

1. winetricks should check if TMPDIR exists and is writable before using it. If not, fall back to /tmp.
2. winetricks should respect SSL_CERT_FILE and CURL_CA_BUNDLE environment variables, or provide a way to specify CA certificates.

Actual Behavior

1. winetricks crashes if TMPDIR doesn't exist.
2. All HTTPS downloads from Wine fail with curl error 77.

Workarounds I've Tried

• unset TMPDIR before running winetricks — works for TMPDIR, but SSL still fails
• Manually copying CA bundle to drive_c/windows/system32/curl-ca-bundle.crt — didn't help (Wine's curl doesn't look there)
• Manual DLL extraction via cabextract + fake registry entries — works but defeats the purpose of winetricks
• Using protontricks instead — same issues, and protontricks has its own problems with pressure-vessel

Suggested Fixes

Fix 1: TMPDIR validation

Before using TMPDIR, add a simple check:

if [ -n "$TMPDIR" ] && [ ! -d "$TMPDIR" ]; then
    w_warn "TMPDIR='$TMPDIR' does not exist, falling back to /tmp"
    unset TMPDIR
fi
w_tmpdir="${TMPDIR:-/tmp}"

This is backwards-compatible and prevents the crash.

Fix 2: SSL certificate support

Make winetricks respect SSL_CERT_FILE and CURL_CA_BUNDLE when downloading files. This would let users point to host CA certificates:

export SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
winetricks vcrun2019

Or add a --cacert option or WINETRICKS_CA_BUNDLE variable.

Related Open Issues

• winetricks fails with mktemp inside pressure-vessel when TMPDIR points to non-existent nix-shell directory Open-Wine-Components/umu-launcher#687 — TMPDIR isolation in pressure-vessel (filed by me)
• wget fails to retrieve https due to GnuTLS #2400 — wget fails with GnuTLS in umu on Fedora 42 (filed by GloriousEggroll)
• pressure-vessel inherits host TZDIR without making it available inside container ValveSoftware/steam-runtime#795 — pressure-vessel inherits host env vars without making them available
• Apply protonfixes to all proton types Heroic-Games-Launcher/HeroicGamesLauncher#4140 — UMU breaks winetricks commands
• heroic: winetricks GUI does not open NixOS/nixpkgs#423767 — heroic: winetricks GUI does not open with umu enabled

Impact

This affects anyone running winetricks inside pressure-vessel containers:

• umu-launcher users (non-Steam Proton runner)
• Heroic Games Launcher users (with UMU enabled)
• Steam Runtime users (for non-Steam games added to Steam)
• Any tool using pressure-vessel for containerization

This isn't NixOS-specific — issue #2400 was filed on Fedora 42 by the creator of GE-Proton. The problem is that pressure-vessel isolates the environment without providing the necessary host resources (CA certificates, writable TMPDIR).

Additional Context

• Host wget works fine — certificates are valid on the host
• Same setup works on Arch Linux with the same Proton version, confirming this is a container isolation issue
• This blocks installation of any Windows dependency that requires HTTPS downloads (VC++, .NET, DirectX, etc.)
• vcrun2019 has been broken in winetricks for years (see issues vcrun2015, 2017 and 2019 are broken (ucrtbase is removed prior to running installer) #1736, winetricks vcrun2019 fails. [Note: SHA256 *does* match, 64-bit prefix] #1770, vcrun2019 sha256sum mismatch #1836, URL is broken for VCRun2019 #2141, vcrun2022 - cabextract doesn't do what's intended with multi-arch installers #2464) — this is just another manifestation

I've spent several days debugging this and filing issues in multiple repositories. The core problem is that winetricks doesn't handle containerized environments gracefully. A few simple checks (TMPDIR validation, SSL_CERT_FILE support) would make a huge difference.

Thanks for maintaining winetricks — it's an essential tool for Linux gaming.