CaCerts.h

//
// Locating the host's CA trust store.
//
// A statically linked binary carries the CA path of the distro it was built on,
// so moving it to another distro breaks certificate verification. Probing the
// well-known locations at runtime keeps a single binary working everywhere,
// while still trusting the host's own store rather than a bundled copy.
//

#ifndef SPEEDTEST_CACERTS_H
#define SPEEDTEST_CACERTS_H

#include <string>
#include <sys/stat.h>

namespace cacerts {

inline bool isFile(const char* path) {
    struct stat st;
    return ::stat(path, &st) == 0 && S_ISREG(st.st_mode) && st.st_size > 0;
}

inline bool isDir(const char* path) {
    struct stat st;
    return ::stat(path, &st) == 0 && S_ISDIR(st.st_mode);
}

// Single-file bundle, empty when none of the known ones exist.
inline const std::string& bundleFile() {
    static const std::string cached = [] {
        static const char* candidates[] = {
            "/etc/ssl/certs/ca-certificates.crt",   // Debian, Ubuntu, Alpine, Arch
            "/etc/pki/tls/certs/ca-bundle.crt",     // Fedora, RHEL, CentOS
            "/etc/ssl/ca-bundle.pem",               // openSUSE
            "/etc/pki/tls/cacert.pem",              // older RHEL
            "/etc/ssl/cert.pem",                    // Alpine, FreeBSD, macOS
        };
        for (auto path : candidates)
            if (isFile(path))
                return std::string(path);
        return std::string();
    }();
    return cached;
}

// Hashed-directory store, used as a fallback when no bundle file is present.
inline const std::string& bundleDir() {
    static const std::string cached = [] {
        static const char* candidates[] = {"/etc/ssl/certs", "/etc/pki/tls/certs"};
        for (auto path : candidates)
            if (isDir(path))
                return std::string(path);
        return std::string();
    }();
    return cached;
}

} // namespace cacerts

#endif //SPEEDTEST_CACERTS_H