oven-sh · cirospaciari · Jul 16, 2026 · Jul 17, 2026 · Jul 17, 2026 · Jul 17, 2026
diff --git a/packages/bun-usockets/src/crypto/openssl.c b/packages/bun-usockets/src/crypto/openssl.c
@@ -162,6 +162,8 @@ static int us_ctx_cache_ex_idx = -1;
  * ca/caFile options or a later addCACert): the per-socket client attach must
  * not replace such a store with the process-shared default roots. */
 static int us_ctx_user_ca_ex_idx = -1;
+/* The resolved system-CA decision the context was built with (stored as value+1 so 0 = unset). */
+static int us_ctx_use_system_ca_ex_idx = -1;
 static int us_ssl_reneg_state_idx = -1;
 /* Per-connection async-SNI suspension state (select_certificate_cb retry). */
 static int us_ssl_sni_pending_idx = -1;
@@ -443,6 +445,7 @@ static void us_ex_idx_init(void) {
   us_sni_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
   us_ctx_cache_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, bun_ssl_ctx_cache_on_free);
   us_ctx_user_ca_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
+  us_ctx_use_system_ca_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
   us_ctx_sni_policy_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
   us_ssl_reneg_state_idx = SSL_get_ex_new_index(0, NULL, NULL, NULL, us_ssl_reneg_state_free);
   us_ssl_sni_pending_idx = SSL_get_ex_new_index(0, NULL, NULL, NULL, us_ssl_sni_pending_free);
@@ -903,13 +906,15 @@ static int us_ssl_ctx_use_privatekey_content(SSL_CTX *ctx, const char *content,
  * the still-empty SSL_CTX_new() store are first replaced by a private full
  * default-root copy, and the context is marked so the per-socket attach keeps
  * it. https://github.com/nodejs/node/blob/v26.3.0/src/crypto/crypto_context.cc#L1831 */
+int us_ssl_ctx_use_system_ca(SSL_CTX *ctx) {
+  us_ex_idx_ensure();
+  intptr_t stored = (intptr_t)SSL_CTX_get_ex_data(ctx, us_ctx_use_system_ca_ex_idx);
+  return stored ? (int)(stored - 1) : us_default_use_system_ca();
+}
+
 static X509_STORE *us_ssl_ctx_get_own_cert_store(SSL_CTX *ctx) {
   X509_STORE *store = SSL_CTX_get_cert_store(ctx);
-  /* us_get_shared_default_ca_store() up-refs before returning, so release
-   * the reference taken just for this comparison. */
-  X509_STORE *shared = us_get_shared_default_ca_store();
-  int store_is_shared = store != NULL && store == shared;
-  X509_STORE_free(shared);
+  int store_is_shared = us_is_shared_default_ca_store(store);
   us_ex_idx_ensure();
   int store_is_empty = 0;
   if (store != NULL && !store_is_shared) {
@@ -921,7 +926,7 @@ static X509_STORE *us_ssl_ctx_get_own_cert_store(SSL_CTX *ctx) {
    * no `ca` configured at all may be seeded with the default roots here. */
   int user_ca = SSL_CTX_get_ex_data(ctx, us_ctx_user_ca_ex_idx) != NULL;
   if (store == NULL || store_is_shared || (store_is_empty && !user_ca)) {
-    X509_STORE *own = us_get_default_ca_store();
+    X509_STORE *own = us_get_default_ca_store(us_ssl_ctx_use_system_ca(ctx));
     if (own == NULL) {
       return NULL;
     }
@@ -1106,6 +1111,9 @@ SSL_CTX *us_ssl_ctx_build_raw(struct us_bun_socket_context_options_t options,
   /* Register the live-count free_func first thing so every exit (including
    * build_fail) balances. The packed reneg policy reuses the same slot. */
   SSL_CTX_set_ex_data(ssl_context, us_ssl_ctx_ex_idx(), NULL);
+  const int use_system_ca = us_resolve_use_system_ca(options.use_system_ca);
+  us_ex_idx_ensure();
+  SSL_CTX_set_ex_data(ssl_context, us_ctx_use_system_ca_ex_idx, (void *)(intptr_t)(use_system_ca + 1));
 
   /* Default options we rely on — changing these breaks the BIO logic. */
   SSL_CTX_set_read_ahead(ssl_context, 1);
@@ -1233,7 +1241,7 @@ SSL_CTX *us_ssl_ctx_build_raw(struct us_bun_socket_context_options_t options,
      * addRootCerts() when `ca` is absent - the handshake-time auto-chain and
      * (for requestCert) client verification both read it. The getter up-refs,
      * so set_cert_store owns exactly one reference per context. */
-    SSL_CTX_set_cert_store(ssl_context, us_get_shared_default_ca_store());
+    SSL_CTX_set_cert_store(ssl_context, us_get_shared_default_ca_store(use_system_ca));
     if (options.request_cert) {
       SSL_CTX_set_verify(ssl_context,
           options.reject_unauthorized ? (SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
@@ -1574,7 +1582,7 @@ void us_internal_ssl_attach(struct us_socket_t *s, SSL_CTX *ctx,
          * A context whose store holds user-provided CAs (ca/caFile options or
          * addCACert) keeps using its own store - overriding it here would
          * hide those CAs from chain verification. */
-        X509_STORE *roots = us_get_shared_default_ca_store();
+        X509_STORE *roots = us_get_shared_default_ca_store(us_ssl_ctx_use_system_ca(ctx));
         if (roots) SSL_set0_verify_cert_store(ssl, roots);
       }
     }

diff --git a/packages/bun-usockets/src/crypto/root_certs.cpp b/packages/bun-usockets/src/crypto/root_certs.cpp
@@ -2,6 +2,7 @@
 #include "./root_certs_header.h"
 #include "./internal/internal.h"
 #include <mutex>
+#include <atomic>
 #include <string.h>
 #include "./default_ciphers.h"
 
@@ -23,22 +24,34 @@ extern "C" void BUN__warn__extra_ca_load_failed(const char* filename, const char
 // Forward declarations for platform-specific functions
 // (Actual implementations are in platform-specific files)
 
-// External variable from Zig CLI arguments
+// External variables from the CLI arguments
 extern "C" bool Bun__Node__UseSystemCA;
-
-// Helper function to check if system CA should be used
-// Checks both CLI flag (--use-system-ca) and environment variable (NODE_USE_SYSTEM_CA=1)
-static bool us_should_use_system_ca() {
-  // Check CLI flag first
+extern "C" bool Bun__Node__NoUseSystemCA;
+// BunCAStore discriminant (Arguments.rs): 1 == --use-openssl-ca.
+extern "C" uint8_t Bun__Node__CAStore;
+static const uint8_t BUN_CA_STORE_OPENSSL = 1;
+
+// The process-wide default: --no-use-system-ca beats everything, then --use-system-ca, then
+// NODE_USE_SYSTEM_CA=1. A thread (node: Environment) started with its own flag overrides this for
+// the contexts it creates — see us_bun_socket_context_options_t.use_system_ca.
+extern "C" int us_default_use_system_ca() {
+  if (Bun__Node__NoUseSystemCA) {
+    return 0;
+  }
   if (Bun__Node__UseSystemCA) {
-    return true;
+    return 1;
   }
-
-  // Check environment variable
   const char *use_system_ca = getenv("NODE_USE_SYSTEM_CA");
   return use_system_ca && strcmp(use_system_ca, "1") == 0;
 }
 
+// Resolve an options-struct tri-state (0: process default, >0: include system roots, <0: exclude).
+extern "C" int us_resolve_use_system_ca(int requested) {
+  if (requested > 0) return 1;
+  if (requested < 0) return 0;
+  return us_default_use_system_ca();
+}
+
 // Platform-specific system certificate loading implementations are separated:
 // - macOS: root_certs_darwin.cpp (Security framework with dynamic loading)
 // - Windows: root_certs_windows.cpp (Windows CryptoAPI)
@@ -207,13 +220,19 @@ STACK_OF(X509) *us_get_root_system_cert_instances() {
   return system_certs;
 }
 
-extern "C" X509_STORE *us_get_default_ca_store() {
+extern "C" X509_STORE *us_get_default_ca_store(int use_system_ca) {
   X509_STORE *store = X509_STORE_new();
   if (store == NULL) {
     return NULL;
   }
 
-  if (!X509_STORE_set_default_paths(store)) {
+  // Node's NewRootCertStore: --use-openssl-ca means OpenSSL's default lookups *instead of* the
+  // bundled roots (system roots ignored); otherwise the bundled roots, plus the system roots when
+  // asked. The default lookups double as the system store's SSL_CERT_FILE / SSL_CERT_DIR overrides,
+  // which node's Linux system loader honours too, so they also come along with use_system_ca.
+  // https://github.com/nodejs/node/blob/v26.3.0/src/crypto/crypto_context.cc#L1099-L1109
+  const int openssl_ca = Bun__Node__CAStore == BUN_CA_STORE_OPENSSL;
+  if ((use_system_ca || openssl_ca) && !X509_STORE_set_default_paths(store)) {
     X509_STORE_free(store);
     return NULL;
   }
@@ -223,7 +242,7 @@ extern "C" X509_STORE *us_get_default_ca_store() {
   STACK_OF(X509) *root_extra_cert_instances = default_ca_certificates->root_extra_cert_instances;
 
   // load all root_cert_instances on the default ca store
-  for (size_t i = 0; i < root_certs_size; i++) {
+  for (size_t i = 0; !openssl_ca && i < root_certs_size; i++) {
     X509 *cert = root_cert_instances[i];
     if (cert == NULL)
       continue;
@@ -239,7 +258,7 @@ extern "C" X509_STORE *us_get_default_ca_store() {
     }
   }
 
-  if (us_should_use_system_ca()) {
+  if (use_system_ca && !openssl_ca) {
     STACK_OF(X509) *root_system_cert_instances = us_get_root_system_cert_instances();
     if (root_system_cert_instances) {
       for (int i = 0; i < sk_X509_num(root_system_cert_instances); i++) {
@@ -253,20 +272,29 @@ extern "C" X509_STORE *us_get_default_ca_store() {
   return store;
 }
 
-// Process-wide immutable default store. Safe to share across SSL_CTXs that
-// don't add per-config CAs (the user-`ca` path in build_raw populates the
-// SSL_CTX's own private, initially-empty store instead). This makes the
-// ~150-root build a once-per-process cost instead of once-per-SSL_CTX, which
-// is what kept Bun.connect({tls:true}) under the node-tls-server.test.ts
-// 100ms cold-path budget in debug+ASAN.
-extern "C" X509_STORE *us_get_shared_default_ca_store() {
-  static X509_STORE *shared = nullptr;
-  static std::once_flag once;
-  std::call_once(once, []() { shared = us_get_default_ca_store(); });
+// Process-wide immutable default stores, one per system-CA decision. Safe to share across SSL_CTXs
+// that don't add per-config CAs (the user-`ca` path in build_raw populates the SSL_CTX's own
+// private, initially-empty store instead). This makes the ~150-root build a once-per-process cost
+// (per variant actually used) instead of once-per-SSL_CTX, which is what kept
+// Bun.connect({tls:true}) under the node-tls-server.test.ts 100ms cold-path budget in debug+ASAN.
+static std::atomic<X509_STORE *> shared_default_ca_store[2] = { nullptr, nullptr };
+
+extern "C" X509_STORE *us_get_shared_default_ca_store(int use_system_ca) {
+  static std::once_flag once[2];
+  int i = use_system_ca ? 1 : 0;
+  std::call_once(once[i], [i]() { shared_default_ca_store[i].store(us_get_default_ca_store(i)); });
+  X509_STORE *shared = shared_default_ca_store[i].load();
   if (shared) X509_STORE_up_ref(shared);
   return shared;
 }
 
+// Whether `store` is one of the process-shared default stores (as opposed to a context's own).
+// Compares against whatever has been built so far; builds nothing.
+extern "C" int us_is_shared_default_ca_store(X509_STORE *store) {
+  return store != nullptr
+      && (store == shared_default_ca_store[0].load() || store == shared_default_ca_store[1].load());
+}
+
 extern "C" const char *us_get_default_ciphers() {
   return DEFAULT_CIPHER_LIST;
 }

diff --git a/packages/bun-usockets/src/crypto/root_certs_header.h b/packages/bun-usockets/src/crypto/root_certs_header.h
@@ -11,5 +11,10 @@ STACK_OF(X509) *us_get_root_system_cert_instances();
 #define CPPDECL extern
 #endif
 
-CPPDECL X509_STORE *us_get_default_ca_store();
-CPPDECL X509_STORE *us_get_shared_default_ca_store();
+CPPDECL int us_default_use_system_ca();
+CPPDECL int us_resolve_use_system_ca(int requested);
+CPPDECL X509_STORE *us_get_default_ca_store(int use_system_ca);
+CPPDECL X509_STORE *us_get_shared_default_ca_store(int use_system_ca);
+CPPDECL int us_is_shared_default_ca_store(X509_STORE *store);
+/* The resolved system-CA decision an SSL_CTX built by us_ssl_ctx_build_raw was created with. */
+CPPDECL int us_ssl_ctx_use_system_ca(SSL_CTX *ctx);
diff --git a/packages/bun-usockets/src/eventing/epoll_kqueue.c b/packages/bun-usockets/src/eventing/epoll_kqueue.c
@@ -515,6 +515,10 @@ void us_loop_run_bun_tick(struct us_loop_t *loop, const struct timespec* timeout
         }
     }
 
+    const uint64_t idle_start_ns = will_idle_inside_event_loop ? us_internal_monotonic_ns() : 0;
+    if (will_idle_inside_event_loop)
+        __atomic_store_n(&loop->data.idle_entry_ns, idle_start_ns, __ATOMIC_SEQ_CST);
+
     /* Fetch ready polls */
 #ifdef LIBUS_USE_EPOLL
     /* A zero timespec already has a fast path in ep_poll (fs/eventpoll.c):
@@ -533,6 +537,18 @@ void us_loop_run_bun_tick(struct us_loop_t *loop, const struct timespec* timeout
         timeout);
 #endif
 
+    if (will_idle_inside_event_loop) {
+        /* us_loop_idle_ns (another thread) retries while idle_seq is odd or changed underneath it, so
+         * it never observes the entry cleared without the park added (a non-monotonic sample). */
+        __atomic_add_fetch(&loop->data.idle_seq, 1, __ATOMIC_SEQ_CST);
+        /* Clock read inside the odd window: a reader's own clock read (taken before it validated an
+         * even seq) is then never later than the park length we record, so samples stay monotonic. */
+        uint64_t now = us_internal_monotonic_ns();
+        __atomic_store_n(&loop->data.idle_entry_ns, 0, __ATOMIC_SEQ_CST);
+        __atomic_add_fetch(&loop->data.idle_ns, now - idle_start_ns, __ATOMIC_SEQ_CST);
+        __atomic_add_fetch(&loop->data.idle_seq, 1, __ATOMIC_SEQ_CST);
+    }
+
     /* Before anything can allocate again. */
     if (handed_off)
         mi_on_thread_idle_end();

diff --git a/packages/bun-usockets/src/eventing/libuv.c b/packages/bun-usockets/src/eventing/libuv.c
@@ -349,6 +349,7 @@ struct us_loop_t *us_create_loop(void *hint,
 
   loop->uv_loop = hint ? hint : uv_loop_new();
   loop->is_default = hint != 0;
+  uv_loop_configure(loop->uv_loop, UV_METRICS_IDLE_TIME);
 
   loop->uv_pre = us_malloc(sizeof(uv_prepare_t));
   uv_prepare_init(loop->uv_loop, loop->uv_pre);

diff --git a/packages/bun-usockets/src/internal/internal.h b/packages/bun-usockets/src/internal/internal.h
@@ -158,6 +158,9 @@ uint64_t us_internal_monotonic_ns(void);
 long long us_internal_sweep_timeout_ns(struct us_loop_t *loop);
 void us_internal_sweep_if_due(struct us_loop_t *loop);
 #endif
+/* Nanoseconds this loop has spent parked, including a park in progress. Safe
+ * from another thread. Both platforms: Rust calls it ungated. */
+uint64_t us_loop_idle_ns(struct us_loop_t *loop);
 void us_internal_free_closed_sockets(us_loop_r loop);
 void us_internal_loop_link_group(struct us_loop_t *loop, struct us_socket_group_t *group);
 void us_internal_loop_unlink_group(struct us_loop_t *loop, struct us_socket_group_t *group);

diff --git a/packages/bun-usockets/src/internal/loop_data.h b/packages/bun-usockets/src/internal/loop_data.h
@@ -76,6 +76,15 @@ struct us_internal_loop_data_t {
      * for lsquic's time-driven state. POSIX folds the deadline into the
      * epoll_pwait2 timeout via getTimeout() instead. */
     struct us_timer_t *quic_timer;
+#endif
+#ifndef LIBUS_USE_LIBUV
+    /* Nanoseconds parked, for eventLoopUtilization(). Read cross-thread —
+     * __atomic_* only. MIRRORED in src/uws_sys/InternalLoopData.rs: this struct
+     * is us_loop_t's first member, so a field here shifts num_polls. */
+    unsigned long long idle_ns;
+    unsigned long long idle_entry_ns;
+    /* Seqlock over the park-exit update of the two fields above (odd while in progress). */
+    unsigned long long idle_seq;
 #endif
     struct us_socket_group_t *iterator;
     char *recv_buf;

diff --git a/packages/bun-usockets/src/libusockets.h b/packages/bun-usockets/src/libusockets.h
@@ -517,6 +517,10 @@ struct us_bun_socket_context_options_t {
     const char *sigalgs;
     /* Colon-separated named-group list applied via SSL_CTX_set1_groups_list. */
     const char *ecdh_curve;
+    /* Whether the default root store of this context includes the system's trusted CAs (node's
+     * per-Environment --use-system-ca): 0 = the process default (CLI flags / NODE_USE_SYSTEM_CA),
+     * 1 = include, -1 = exclude. Only matters when no `ca`/`ca_file_name` is given. */
+    int use_system_ca;
 };
 
 enum create_bun_socket_error_t {

diff --git a/packages/bun-usockets/src/loop.c b/packages/bun-usockets/src/loop.c
@@ -119,6 +119,36 @@ void us_internal_sweep_if_due(struct us_loop_t *loop) {
 #endif
 
 
+/* The clock us_loop_idle_ns accumulates in, so eventLoopUtilization's elapsed and idle share one
+ * time base (they diverge across system sleep otherwise: CLOCK_MONOTONIC keeps counting on macOS,
+ * the uptime clock std::time::Instant uses does not). */
+uint64_t us_loop_idle_clock_ns(void) {
+#ifdef LIBUS_USE_LIBUV
+    return uv_hrtime();
+#else
+    return us_internal_monotonic_ns();
+#endif
+}
+
+uint64_t us_loop_idle_ns(struct us_loop_t *loop) {
+#ifdef LIBUS_USE_LIBUV
+    return uv_metrics_idle_time(loop->uv_loop);
+#else
+    uint64_t idle, entry, now;
+    for (;;) {
+        uint64_t seq = __atomic_load_n(&loop->data.idle_seq, __ATOMIC_SEQ_CST);
+        if (seq & 1) continue;
+        idle = __atomic_load_n(&loop->data.idle_ns, __ATOMIC_SEQ_CST);
+        entry = __atomic_load_n(&loop->data.idle_entry_ns, __ATOMIC_SEQ_CST);
+        now = entry > 0 ? us_internal_monotonic_ns() : 0;
+        if (__atomic_load_n(&loop->data.idle_seq, __ATOMIC_SEQ_CST) == seq) break;
+    }
+    if (entry > 0 && now > entry)
+        idle += now - entry;
+    return idle;
+#endif
+}
+
 void us_internal_loop_data_init(struct us_loop_t *loop, void (*wakeup_cb)(struct us_loop_t *loop),
     void (*pre_cb)(struct us_loop_t *loop), void (*post_cb)(struct us_loop_t *loop)) {
     // We allocate with calloc, so we only need to initialize the specific fields in use.

diff --git a/packages/bun-usockets/src/quic.c b/packages/bun-usockets/src/quic.c
@@ -24,10 +24,11 @@
 #include <ws2tcpip.h>
 #endif
 
+#include "crypto/root_certs_header.h"
+
 extern SSL_CTX *us_ssl_ctx_build_raw(
     struct us_bun_socket_context_options_t options,
     enum create_bun_socket_error_t *err);
-extern X509_STORE *us_get_default_ca_store(void);
 
 #define US_QUIC_READ_BUF (16 * 1024)
 
@@ -1156,8 +1157,9 @@ us_quic_socket_context_t *us_create_quic_client_context(
     SSL_CTX_set_max_proto_version(ssl, TLS1_3_VERSION);
     /* Same root store the H1/H2 client uses (bundled Mozilla roots + platform
      * CAs + NODE_EXTRA_CA_CERTS); set_default_verify_paths alone doesn't find
-     * the system store on macOS/Windows. */
-    SSL_CTX_set_cert_store(ssl, us_get_default_ca_store());
+     * the system store on macOS/Windows. The shared store is never mutated on
+     * this path, and set_cert_store takes the getter's up-ref. */
+    SSL_CTX_set_cert_store(ssl, us_get_shared_default_ca_store(us_default_use_system_ca()));
     SSL_CTX_set_custom_verify(ssl, SSL_VERIFY_PEER, us_quic_client_verify);
 
     us_quic_socket_context_t *ctx = (us_quic_socket_context_t *)

diff --git a/packages/bun-uws/src/App.h b/packages/bun-uws/src/App.h
@@ -86,6 +86,8 @@ namespace uWS {
         int allow_partial_trust_chain = 0;
         const char *sigalgs = nullptr;
         const char *ecdh_curve = nullptr;
+        /* 0 = process default, 1 = include system CAs, -1 = exclude (see libusockets.h) */
+        int use_system_ca = 0;
 
         /* Conversion operator used internally */
         operator struct us_bun_socket_context_options_t() const {