[CFX-6924] fix(tls): repair Windows cert export

[cdevent]

and stop swallowing TLS errors

Three defects that compounded into an undiagnosable failure: the export broke, the error explaining it was discarded, and there was no fallback diagnostic.

1. Pin PSModulePath for the cert-export subprocess.

ExportWindowsCerts spawned powershell.exe with the parent environment. The Cert: drive comes from Microsoft.PowerShell.Security, which autoloads only if PSModulePath includes the Windows PowerShell system module directory. pwsh 7 sets a value that omits it, and CI runners often mangle it -- the child then could not enumerate any store, -ErrorAction SilentlyContinue ate the DriveNotFoundException, and empty stdout surfaced as "no certificates found in Windows cert store".

The child now gets a pinned PSModulePath. The script also imports the module explicitly and asserts the Cert: drive exists, so a genuine module problem reports itself instead of masquerading as an empty store. Per-store SilentlyContinue is kept, since an individual store may legitimately be empty.

Verified on Windows 11 25H2 against the same broken PSModulePath that reproduces the bug: v0.2.83 exits 1 with no bundle, the fixed binary exits 0 and writes 73 certificates.

2. Make cmd.ReportError the single error reporter.

Cobra skips printing when the executed command sets SilenceErrors: true, and main.go discarded the error entirely -- so anything raised by the root PersistentPreRunE vanished for the 11 commands setting that flag, including all of auth. "dr --ca-cert auth check" exited 1 with zero bytes on both streams, on every platform. A typo in a CA path silently fell back to system trust.

RootCmd now sets SilenceErrors so cobra never prints, and main reports through cmd.ReportError, which honours the existing cli.ErrSilent contract. Errors are printed exactly once. ExecuteContext returns unwrapped, since its "execute root command:" prefix would otherwise leak into user-facing output.

3. Surface the subprocess's stderr.

cmd.Output already captures the child's stderr into ExitError.Stderr and the code dropped it. It is now included in the error, and the empty-store message says which stores were checked.

Tests: table tests for the PSModulePath helpers (kept build-tag free so they run on every host, not only Windows) and for ReportError, plus a guard that RootCmd.SilenceErrors stays true. task lint passes for linux, darwin and windows; task test passes.

RATIONALE

CHANGES

Same A/B, same broken PSModulePath, now confirmed on Windows Server 2025 as well as Windows 11 25H2. And the silent-failure fix works there too — --ca-cert with a bad path printed one clear line where it previously printed nothing.
OLD (installed v0.2.85) -> exit=1 bundle=False "no certificates found in Windows cert store"
NEW (fixed 371a3ad) -> exit=0 bundle=True

PR Automation

Comment-Commands: Trigger CI by commenting on the PR:

• /trigger-smoke-test or /trigger-test-smoke - Run smoke tests
• /trigger-install-test or /trigger-test-install - Run installation tests

Labels: Apply labels to trigger workflows:

• run-smoke-tests or go - Run smoke tests on demand (only works for non-forked PRs)

Important

For Forked PRs: The run-smoke-tests label won't work. A required Smoke Tests check will block merge until a maintainer acts:

• A maintainer uses /approve-smoke-tests to run smoke tests (results will set the check)
• A maintainer uses /skip-smoke-tests to bypass the check without running tests

Please comment requesting a maintainer review if you need smoke tests to run.

---

Note

Medium Risk
Touches TLS setup and Windows trust-bundle export on the critical path for HTTPS; changes are targeted fixes with tests but affect how cert/TLS failures surface on all platforms.

Overview
Fixes CFX-6924, where Windows cert export could fail silently and root TLS/config errors could exit with no stderr output.

Windows cert export now spawns powershell.exe with a pinned PSModulePath (helpers in internal/tls/psmodulepath.go) so Microsoft.PowerShell.Security and the Cert: drive load under pwsh/CI environments. The script imports the module explicitly, checks the Cert provider, includes subprocess stderr on failure, and clarifies the truly-empty-store case.

CLI errors are centralized: RootCmd.SilenceErrors = true, new cmd.ReportError (respects cli.ErrSilent), and main prints failures before exit. ExecuteContext returns errors unwrapped so users do not see an extra execute root command: prefix. Tests lock in ReportError behavior and SilenceErrors on the root command.

^{Reviewed by Cursor Bugbot for commit 8ea508f. Configure here.}

[datarobot-pr-review-router]

🎫 Jira: CFX-6924 — Test Private CA support on Windows

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8ea508f. Configure here.}

[cursor]

Duplicate auth error output

Medium Severity

Centralizing on ReportError while leaving self-reporting paths returning plain errors re-prints failures that were already shown. auth login calls log.Error then returns err, and EnsureAuthenticatedE returns "authentication failed" after EnsureAuthenticated already wrote user messages, so commands that previously relied on SilenceErrors (including dr auth login and dr dotenv update) now emit duplicate stderr lines.

Suggested change

	cmd.ReportError(os.Stderr, err)
	return cli.ErrSilent

(in cmd/auth/login/cmd.go after each log.Error, and have EnsureAuthenticatedE return cli.ErrSilent instead of errors.New("authentication failed"))

Additional Locations (1)

• cmd/exit.go#L34-L41

 

^{Triggered by project rule: Bugbot Rules for DataRobot CLI}

^{Reviewed by Cursor Bugbot for commit 8ea508f. Configure here.}

[cdevent]

Confirmed and fixed in 371a3ad — this was a real regression from centralizing error reporting. Thanks.

What I verified before changing anything. cmd/auth/login/cmd.go already had the correct pattern in two places (return cli.ErrSilent after log.Error, lines 57 and 64) and violated it in three, so the fix was to follow the file's own convention rather than revert the centralization. All three now return cli.ErrSilent.

For EnsureAuthenticatedE I checked that ErrSilent cannot hide a failure — every path where EnsureAuthenticated returns false reports first: ReportEnvCredentialsError + reportStoredProfileNotUsed, GetBaseURLOrAsk (message emitted internally), both skipAuthFlow branches, and the two log.Error calls for key retrieval and config write. So the message is always already on screen.

Empirically: dr --skip-auth auth login now prints one line, not two.

Three related paths I deliberately left alone, having checked each:

• cmd/self/update and cmd/self/completion print then return errors, but neither sets SilenceErrors — cobra printed those before and main prints them now, so output is unchanged.
• auth.WriteConfigFileSilent logs and returns the error, but its only command-level caller (auth/logout) already returns ErrSilent. It does double-log with auth login, which is pre-existing and out of scope here.
• component/add and component/update set SilenceErrors: true and never returned ErrSilent, so their errors were previously swallowed entirely. Centralizing fixed a second silent-failure case: dr component add outside a repo root now reports You must be in the repository root directory. instead of exiting 1 in silence.

Tests added for both fixed paths. task lint is clean for linux/darwin/windows.

Unrelated flaky test, for the record (not touched by this PR): TestExecutePluginContextCancellation failed in 2 of 4 full-suite runs on this branch. internal/plugin/exec_test.go:219 sleeps a fixed 500 ms to let the subprocess install its SIGTERM trap; under a parallel -race run that is sometimes not enough, cancel() lands first, and the shell takes SIGTERM's default action — exit -1 and no marker file. It passes 5/5 in isolation and the suite runs with -shuffle=on, so ordering varies. Worth its own ticket to poll for a readiness marker instead of sleeping.

[datarobot-pr-review-router]

Code Ownership

Cli Maintainers

• cmd/auth/login/cmd.go
• cmd/auth/login/cmd_test.go
• cmd/exit.go
• cmd/exit_test.go
• cmd/root.go
• internal/auth/auth.go
• internal/auth/auth_test.go
• internal/tls/psmodulepath.go
• internal/tls/psmodulepath_test.go
• internal/tls/tls_windows.go
• main.go

Review requested from the teams above. Labels will be removed automatically upon approval.

[github-actions]

🚀 Smoke tests triggered! Running on Linux and Windows...

[github-actions]

✅ All smoke tests passed!

✅ Linux: success
✅ Windows: success

View run details

[chasdr]

LGTM 👍

one non-blocking note on a file outside this diff: the centralization changes cmd/component/update/cmd.go behavior. the uv-not-installed path (around line 181) logs "uv is not installed." and then returns execErr, so main.ReportError now also prints the raw Error: exec "uv".... before, that return was swallowed and the user saw just the one friendly line. did you want that path to return cli.ErrSilent since it already printed its own message?