Claude Code v2.1.40 ·
macOS Sandbox: TLS Certificate Verification
EntryKind: in v2.1.40,
ChangesSection of the release
What
New setting to allow Go programs to verify TLS certificates via trustd agent.
Usage
Configure in sandbox settings:
{
"enableWeakerNetworkIsolation": true
}
Details
- Required for Go programs (gh, gcloud, terraform, kubectl) using MITM proxies with custom CAs
- Enables access to
com.apple.trustd.agent mach service - Security trade-off: Opens potential data exfiltration vector through trustd
Evidence
Trustd agent setting (search for "Enable weaker network isolation", "com.apple.trustd.agent")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
See this entry in the whole of v2.1.40 →
