fix(desktop): treat empty cert paths as unset; error on non-UTF-8 passphrase

More review follow-ups on the native mTLS config:

- Filter set-but-empty GEOLIBRE_HTTP_CA_CERT and GEOLIBRE_HTTP_CLIENT_CERT the
  same way as the passphrase, so ${SECRET:-}-style empty values are treated as
  unset instead of read as the path "" (which would fail on fs::read and, since
  the guarded client is cached, permanently break every native fetch).
- Surface a non-UTF-8 GEOLIBRE_HTTP_CLIENT_CERT_PASSWORD as a clear error rather
  than silently dropping it, since the PKCS#12 loader takes a &str passphrase.
- Document that the configured client certificate is held on the shared native
  HTTP client and is presented to any host that requests one during the TLS
  handshake, so it should only be configured when the app's hosts are trusted.

Author: giswqs

apps/geolibre-desktop/src-tauri/src/lib.rs

@@ -763,9 +763,11 @@ fn client_cert_password_without_path(has_cert_path: bool, has_password: bool) ->
     has_password && !has_cert_path
 }
 
-/// Load extra CA certificate(s) named by [`HTTP_CA_CERT_ENV`], if any.
+/// Load extra CA certificate(s) named by [`HTTP_CA_CERT_ENV`], if any. A
+/// set-but-empty value (common from `CA_CERT=${SECRET:-}` env interpolation) is
+/// treated as unset rather than read as the path `""`.
 fn extra_ca_certificates() -> Result<Vec<reqwest::Certificate>, String> {
-    let Some(path) = env::var_os(HTTP_CA_CERT_ENV) else {
+    let Some(path) = env::var_os(HTTP_CA_CERT_ENV).filter(|value| !value.is_empty()) else {
         return Ok(Vec::new());
     };
     let path = PathBuf::from(path);
@@ -777,14 +779,22 @@ fn extra_ca_certificates() -> Result<Vec<reqwest::Certificate>, String> {
 
 /// Load the mutual-TLS client identity named by [`HTTP_CLIENT_CERT_ENV`], if any.
 fn client_identity() -> Result<Option<ClientIdentity>, String> {
-    // Treat an empty passphrase as unset: env interpolation in Docker/K8s/.env
+    // Treat missing or empty as unset: env interpolation in Docker/K8s/.env
     // tooling (e.g. `PASSWORD=${SECRET:-}`) commonly yields "" rather than
     // leaving the variable unset, which must not force the PKCS#12 path or trip
-    // the stray-passphrase error below.
-    let password = env::var(HTTP_CLIENT_CERT_PASSWORD_ENV)
-        .ok()
-        .filter(|value| !value.is_empty());
-    let Some(path) = env::var_os(HTTP_CLIENT_CERT_ENV) else {
+    // the stray-passphrase error below. A non-UTF-8 value is surfaced as an error
+    // rather than dropped, since the PKCS#12 loader takes a `&str` passphrase.
+    let password = match env::var(HTTP_CLIENT_CERT_PASSWORD_ENV) {
+        Ok(value) if value.is_empty() => None,
+        Ok(value) => Some(value),
+        Err(env::VarError::NotPresent) => None,
+        Err(env::VarError::NotUnicode(_)) => {
+            return Err(format!("{HTTP_CLIENT_CERT_PASSWORD_ENV} is not valid UTF-8"));
+        }
+    };
+    // A set-but-empty cert path is likewise treated as unset, so it does not
+    // bypass the stray-passphrase guard below or fail later on `fs::read("")`.
+    let Some(path) = env::var_os(HTTP_CLIENT_CERT_ENV).filter(|value| !value.is_empty()) else {
         if client_cert_password_without_path(false, password.is_some()) {
             return Err(format!(
                 "{HTTP_CLIENT_CERT_PASSWORD_ENV} is set but {HTTP_CLIENT_CERT_ENV} is not; \

docs/architecture.md

@@ -129,6 +129,14 @@ identities use the platform native-tls backend (SChannel on Windows, Secure
 Transport on macOS, OpenSSL on Linux), which also reads the OS trust store.
 Convert a PKCS#12 export to PEM with
 `openssl pkcs12 -in cert.p12 -out cert.pem -nodes` if you prefer the rustls path.
+A set-but-empty value for any of these variables is treated as unset.
+
+The configured client certificate is held on the shared native HTTP client and
+is therefore **presented to any HTTPS server that requests one** during a native
+fetch (tile, style, and OGC hosts a project points at), not only the endpoint the
+certificate was issued for. TLS sends a client certificate only when the server
+asks for one, so this is not an unconditional disclosure, but configure a client
+certificate only when the hosts the app talks to are trusted.
 
 ## Performance: map rendering on Linux (WebKitGTK)