fix(desktop): trust native roots for relay websockets

desktop/src-tauri/Cargo.toml

@@ -77,7 +77,9 @@ infer = "0.19"
 hex = "0.4"
 ed25519-dalek = "=3.0.0-rc.0"
 tokio = { version = "1", features = ["fs", "sync", "rt", "macros", "time", "net", "io-util"] }
-tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots"] }
+# Match reqwest's platform trust behavior so native WebSockets can reach
+# relays secured by an OS-trusted private CA.
+tokio-tungstenite = { version = "0.29", features = ["rustls-tls-native-roots"] }
 tokio-util = { version = "0.7", features = ["rt"] }
 bytes = "1"
 futures-util = "0.3"

desktop/src-tauri/src/native_websocket.rs

@@ -349,6 +349,22 @@ mod tests {
         Channel::new(|_: InvokeResponseBody| Ok(()))
     }
 
+    #[tokio::test]
+    #[ignore = "requires BUZZ_TEST_WSS_URL and network access"]
+    async fn configured_wss_trusts_native_platform_roots() {
+        install_crypto_provider();
+        let url = std::env::var("BUZZ_TEST_WSS_URL")
+            .expect("BUZZ_TEST_WSS_URL must name the WSS endpoint to verify");
+
+        tokio::time::timeout(
+            CONNECT_TIMEOUT,
+            tokio_tungstenite::connect_async(url.as_str()),
+        )
+        .await
+        .expect("configured WSS endpoint should complete before the connection timeout")
+        .expect("configured WSS endpoint should trust the platform certificate store");
+    }
+
     #[tokio::test]
     async fn secure_websocket_reaches_tls_without_panicking() {
         install_crypto_provider();