From 046e4838611914cd71d2739b187ec7e16d1107ed Mon Sep 17 00:00:00 2001
From: Adrian Bonpin <adrianbonpin@gmail.com>
Date: Sun, 28 Jun 2026 17:33:55 +0800
Subject: [PATCH] fix(plugin): hybrid SSL context - verify when possible, fall
 back gracefully

---
 plugins/decky-vault/main.py | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/plugins/decky-vault/main.py b/plugins/decky-vault/main.py
index 2eab047..7debaf4 100644
--- a/plugins/decky-vault/main.py
+++ b/plugins/decky-vault/main.py
@@ -3,6 +3,19 @@ import json
 import os
 import ssl
 
+def _get_ssl_context():
+    """Create an SSL context, trying verification first, falling back to unverified.
+    This handles systems where the CA bundle is missing or outdated (e.g., Steam Deck)."""
+    try:
+        ctx = ssl.create_default_context()
+        # Test that the context can actually verify by checking it has CAs
+        if ctx.get_ca_certs():
+            return ctx
+    except Exception:
+        pass
+    # Fall back to unverified if default context fails
+    return ssl._create_unverified_context()
+
 try:
     import decky
 except ImportError:
@@ -350,7 +363,7 @@ benchmark_percentiles=97,AVG,1,0.1
                 method="POST"
             )
 
-            context = ssl._create_unverified_context()
+            context = _get_ssl_context()
             with urllib.request.urlopen(req, timeout=30, context=context) as response:
                 status = response.status
                 body = response.read().decode('utf-8')
@@ -386,7 +399,7 @@ benchmark_percentiles=97,AVG,1,0.1
                 headers={"x-api-key": api_key},
                 method="GET"
             )
-            context = ssl._create_unverified_context()
+            context = _get_ssl_context()
             with urllib.request.urlopen(req, timeout=10, context=context) as response:
                 # A 404 (game not found) still means the API key is valid
                 return {"valid": True}