fix(tls): bundle WE1 intermediate CA for GraalVM native binary

api.qtsurfer.net omits the WE1 (Google Trust Services) intermediate from
its TLS chain. JVM builds AIA-chase to recover it; GraalVM native images
cannot.

Bundles tls/google-we1.pem (valid until 2029-02-20) as a classpath
resource. At startup, Main.injectBundledIntermediates() loads it, makes it
a trust anchor in a composite X509TrustManager, and sets it as the default
SSLContext before any outbound connection. HttpClient.newBuilder() picks up
SSLContext.getDefault() automatically.

Fixes: auth() failed: HTTP 0 on macOS arm64 and Linux amd64 native binaries.

Bumps version to 0.3.2.

Author: mrmx

CHANGELOG.md

@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.3.2] — 2026-06-13
+
+### Fixed 🐛
+
+- **Native binary TLS on macOS/Linux: `auth() failed: HTTP 0`** — `api.qtsurfer.net` omits the WE1 intermediate CA from its TLS handshake. GraalVM native images cannot AIA-chase at runtime, causing the TLS handshake to fail silently. The WE1 certificate (Google Trust Services, valid until 2029) is now bundled as a classpath resource and injected as a trust anchor at startup via a composite `X509TrustManager` set as the JVM default `SSLContext`, before the first outbound connection. The fat JAR is unaffected (JVM AIA-chases automatically).
+
 ## [0.3.1] — 2026-06-12
 
 ### Added ✨

README.md

@@ -41,7 +41,7 @@ The installer detects your platform and picks the right delivery:
 Pin a version or override the destination:
 
 ```bash
-VERSION=0.3.1 INSTALL_DIR=~/.local/bin \
+VERSION=0.3.2 INSTALL_DIR=~/.local/bin \
   curl -fsSL https://raw.githubusercontent.com/QTSurfer/mcp-java/main/install.sh | bash
 ```
 

pom.xml

@@ -5,7 +5,7 @@
 
     <groupId>com.qtsurfer</groupId>
     <artifactId>mcp-java</artifactId>
-    <version>0.3.1</version>
+    <version>0.3.2</version>
     <packaging>jar</packaging>
     <name>qtsurfer-mcp-java</name>
 

src/main/java/com/qtsurfer/mcp/Main.java

@@ -9,6 +9,15 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.io.InputStream;
+import java.security.KeyStore;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509TrustManager;
+
 /**
  * Entry point for the QTSurfer MCP server.
  *
@@ -65,6 +74,7 @@ public static void main(String[] args) {
    * killing the JVM.
    */
   static int run(String[] args) {
+    injectBundledIntermediates();
     if (hasFlag(args, "--help") || hasFlag(args, "-h")) {
       printUsage();
       return 0;
@@ -118,6 +128,68 @@ static AuthenticatedClient authenticate(String apikey, String baseUrl) {
     return QTSurfer.auth(apikey, opts);
   }
 
+  /**
+   * GraalVM native images cannot AIA-chase at runtime. When the server omits an
+   * intermediate CA from its TLS chain, the handshake fails with HTTP 0.
+   * This method loads bundled intermediate certs and adds them as trust anchors
+   * in a composite SSLContext set as the JVM default, so HttpClient picks them up.
+   */
+  private static void injectBundledIntermediates() {
+    try {
+      KeyStore extras = KeyStore.getInstance(KeyStore.getDefaultType());
+      extras.load(null, null);
+      int added = 0;
+      for (String name : new String[]{"google-we1"}) {
+        try (InputStream in = Main.class.getResourceAsStream("/tls/" + name + ".pem")) {
+          if (in == null) continue;
+          X509Certificate cert = (X509Certificate)
+              CertificateFactory.getInstance("X.509").generateCertificate(in);
+          extras.setCertificateEntry(name, cert);
+          added++;
+        }
+      }
+      if (added == 0) return;
+
+      TrustManagerFactory platformTmf = TrustManagerFactory.getInstance(
+          TrustManagerFactory.getDefaultAlgorithm());
+      platformTmf.init((KeyStore) null);
+      X509TrustManager platformTm = (X509TrustManager) platformTmf.getTrustManagers()[0];
+
+      TrustManagerFactory extrasTmf = TrustManagerFactory.getInstance(
+          TrustManagerFactory.getDefaultAlgorithm());
+      extrasTmf.init(extras);
+      X509TrustManager extrasTm = (X509TrustManager) extrasTmf.getTrustManagers()[0];
+
+      SSLContext ctx = SSLContext.getInstance("TLS");
+      ctx.init(null, new TrustManager[]{new X509TrustManager() {
+        @Override
+        public void checkClientTrusted(X509Certificate[] chain, String authType)
+            throws java.security.cert.CertificateException {
+          platformTm.checkClientTrusted(chain, authType);
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] chain, String authType)
+            throws java.security.cert.CertificateException {
+          try {
+            platformTm.checkServerTrusted(chain, authType);
+          } catch (java.security.cert.CertificateException e) {
+            extrasTm.checkServerTrusted(chain, authType);
+          }
+        }
+
+        @Override
+        public X509Certificate[] getAcceptedIssuers() {
+          return platformTm.getAcceptedIssuers();
+        }
+      }}, null);
+      SSLContext.setDefault(ctx);
+      log.debug("Injected {} bundled intermediate CA(s) into SSLContext", added);
+    } catch (Exception e) {
+      log.warn("Failed to inject bundled TLS intermediates: {}", e.getMessage());
+    }
+  }
+
   private static void printUsage() {
     System.out.print(
         "\n"

src/main/resources/META-INF/native-image/com.qtsurfer/mcp-java/resource-config.json

@@ -1,7 +1,8 @@
 {
   "resources": {
     "includes": [
-      {"pattern": "\\Qbuild.properties\\E"}
+      {"pattern": "\\Qbuild.properties\\E"},
+      {"pattern": "\\Qtls/google-we1.pem\\E"}
     ]
   }
 }

src/main/resources/tls/google-we1.pem

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICjjCCAjOgAwIBAgIQf/NXaJvCTjAtkOGKQb0OHzAKBggqhkjOPQQDAjBQMSQw
+IgYDVQQLExtHbG9iYWxTaWduIEVDQyBSb290IENBIC0gUjQxEzARBgNVBAoTCkds
+b2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMjMxMjEzMDkwMDAwWhcN
+MjkwMjIwMTQwMDAwWjA7MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRy
+dXN0IFNlcnZpY2VzMQwwCgYDVQQDEwNXRTEwWTATBgcqhkjOPQIBBggqhkjOPQMB
+BwNCAARvzTr+Z1dHTCEDhUDCR127WEcPQMFcF4XGGTfn1XzthkubgdnXGhOlCgP4
+mMTG6J7/EFmPLCaY9eYmJbsPAvpWo4IBAjCB/zAOBgNVHQ8BAf8EBAMCAYYwHQYD
+VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBIGA1UdEwEB/wQIMAYBAf8CAQAw
+HQYDVR0OBBYEFJB3kjVnxP+ozKnme9mAeXvMk/k4MB8GA1UdIwQYMBaAFFSwe61F
+uOJAf/sKbvu+M8k8o4TVMDYGCCsGAQUFBwEBBCowKDAmBggrBgEFBQcwAoYaaHR0
+cDovL2kucGtpLmdvb2cvZ3NyNC5jcnQwLQYDVR0fBCYwJDAioCCgHoYcaHR0cDov
+L2MucGtpLmdvb2cvci9nc3I0LmNybDATBgNVHSAEDDAKMAgGBmeBDAECATAKBggq
+hkjOPQQDAgNJADBGAiEAokJL0LgR6SOLR02WWxccAq3ndXp4EMRveXMUVUxMWSMC
+IQDspFWa3fj7nLgouSdkcPy1SdOR2AGm9OQWs7veyXsBwA==
+-----END CERTIFICATE-----