It looks like Go is skipping user-added certs?

[Wowfunhappy]

https://github.com/ModernMavericks/golang/blob/a378ff596b57e04f17b176739b994c8d076d1acf/lines/126/patches/0008-root-keychainunion-darwin.patch

Darwin integration for the keychain-union trust model: enumerate the SYSTEM and ADMIN keychain trust domains (skipping USER, which can block on a GUI prompt and hang a headless daemon),

So if the user adds a cert in Keychain Access it sounds like Go will just ignore it? Do you know what "GUI prompt" the comment here is talking about?

Go fallback verifier forced on for macOS too old for a working SecTrust engine (< 10.14, where it faults in-framework).

I wonder if this is the fault that I fixed in Go 1.19 (well, really it was krackers's fix, he read the crash report and told me what to do) by patching root_darwin.go? See "step 2" in https://github.com/Wowfunhappy/AquaProxy/blob/master/README.md:

In /usr/local/go/src/crypto/x509/root_darwin.go, change:

-	policies := macOS.CFArrayCreateMutable()
-	defer macOS.ReleaseCFArray(policies)
	sslPolicy := macOS.SecPolicyCreateSSL(opts.DNSName)
-	macOS.CFArrayAppendValue(policies, sslPolicy)
+	defer macOS.CFRelease(sslPolicy)

-	trustObj, err := macOS.SecTrustCreateWithCertificates(certs, policies)
+	trustObj, err := macOS.SecTrustCreateWithCertificates(certs, sslPolicy)