Route app network TLS policy through platform services

docs/modernization/build-inventory.md

@@ -554,12 +554,14 @@ Known local toolchain state:
   callbacks, recording cleanup, exported-image publishing, persistent storage
   flushing, document browse roots, native UI/window state saving, live
   asset/layout reload policy, diagnostic stacktrace/crash hooks,
-  prepared-file writable target selection, and prepared-file save/download
-  handoff; PPBR and MP4 export dialogs consume the same prepared-file policy
-  at runtime instead of spelling mobile/Web branches locally, and layer/frame
-  collection export dialogs consume the work-directory collection policy before
-  `pp_app_core` plans immediate collection export versus directory-picker stem
-  export;
+  prepared-file writable target selection, network TLS verification policy,
+  and prepared-file save/download handoff; PPBR and MP4 export dialogs consume
+  the same prepared-file policy at runtime instead of spelling mobile/Web
+  branches locally, layer/frame collection export dialogs consume the
+  work-directory collection policy before `pp_app_core` plans immediate
+  collection export versus directory-picker stem export, and app-owned curl
+  upload/download/license helpers consume the TLS policy instead of spelling
+  Android branches locally;
   Windows
   live app execution now uses injected
   `WindowsPlatformServices` from
@@ -595,10 +597,12 @@ Known local toolchain state:
   canvas project-open, layer UI, and action-history execution.
 - `src/legacy_cloud_services.*` is the current app-shell bridge for cloud
   upload, bulk upload, browse dialog, and download execution. It keeps those
-  live paths on the `pp_app_core` `CloudServices` contract while legacy
-  save-before-upload, progress/message UI, network upload/download helpers,
-  OpenGL context guarding, `NodeDialogCloud`, project open, layer refresh, and
-  action-history reset remain tracked by `DEBT-0038`.
+  live paths on the `pp_app_core` `CloudServices` contract while the app-owned
+  curl upload/download/license helpers now ask `PlatformServices` for TLS
+  verification policy. Legacy save-before-upload, progress/message UI, network
+  upload/download helper ownership, OpenGL context guarding, `NodeDialogCloud`,
+  project open, layer refresh, and action-history reset remain tracked by
+  `DEBT-0038`.
 - `pano_cli simulate-app-session` exposes `pp_app_core` project-open,
   app-close, save, save-as, save-version, and save-before-workflow decisions
   as JSON and is covered for clean, dirty, already-prompting, missing-canvas,

docs/modernization/debt.md

@@ -35,7 +35,7 @@ agent or engineer to remove them without reconstructing context from chat.
 | DEBT-0014 | Open | Modernization | `windows-clangcl-asan` now configures as a headless Ninja/clang-cl preset and uses the release MSVC runtime required by ASan, but local builds still fail because installed clang-cl 18.1.8 is paired with VS 2026-preview STL headers that require Clang 20 or newer | Sanitizer validation should be local and repeatable, but this machine's compiler/header pairing is incompatible | `cmake --fresh --preset windows-clangcl-asan`; `cmake --build --preset windows-clangcl-asan --target pp_foundation` | Install/use Clang 20+ with the VS 2026 STL, or point the preset at a compatible VS 2022 toolchain, then make `platform-build.ps1 -Presets windows-clangcl-asan` pass for the headless matrix |
 | DEBT-0015 | Open | Modernization | Cursor visibility requests now consume pure `pp_app_core` planning through `pano_cli plan-cursor-visibility`, `App::show_cursor`/`App::hide_cursor` dispatch through `PlatformServices` without platform guards, and Windows live execution uses injected `WindowsPlatformServices`, but macOS cursor execution still reaches the retained fallback adapter | Keep canvas cursor behavior stable while platform shells are extracted incrementally | `pp_app_core_document_platform_io_tests`; `pano_cli plan-cursor-visibility --visible`; `ctest --preset desktop-fast --build-config Debug` | Cursor visibility execution is owned by injected `pp_platform_*` services for every supported platform |
 | DEBT-0016 | Open | Modernization | Clipboard get/set requests now consume pure `pp_app_core` planning through `pano_cli plan-clipboard-read` and `pano_cli plan-clipboard-write`, and Windows live execution uses injected `WindowsPlatformServices`, but Apple/Android clipboard execution still reaches retained fallback adapter branches from `App::clipboard_get_text` and `App::clipboard_set_text` | Keep picker/color text clipboard behavior stable while platform shells are extracted incrementally | `pp_app_core_document_platform_io_tests`; `pano_cli plan-clipboard-write --text #ff00aa`; `ctest --preset desktop-fast --build-config Debug` | Clipboard execution is owned by injected `pp_platform_*` services for every supported platform |
-| DEBT-0017 | Open | Modernization | Startup storage path preparation, `App::clipboard_get_text`, `App::clipboard_set_text`, `App::show_cursor`, `App::hide_cursor`, `App::showKeyboard`, `App::hideKeyboard`, `App::display_file`, `App::share_file`, native app/window close, UI-thread lifecycle hooks, render-context acquire/release/present hooks, render-target binding hooks, render platform hint hooks, render debug callback hooks, render-capture frame hooks, recording cleanup, live asset/layout reload policy, diagnostic stacktrace/crash hooks, per-frame platform hooks, `App::pick_image`, `App::pick_file`, the non-writer `App::pick_file_save`, `App::pick_dir`, prepared-file save/download handoff, and work-directory document export collection policy now call the SDK-free `pp::platform::PlatformServices` interface, and Windows injects `WindowsPlatformServices` from `src/platform_windows/windows_platform_services.*`; non-Windows live implementations still use `src/platform_legacy/legacy_platform_services.*`, a named fallback adapter that forwards to retained Apple/Android/Linux/Web bridge functions and retained no-op branches | Preserve behavior while moving platform execution behind a testable service boundary before platform shell implementations are injected | `pp_platform_api_tests`; `pp_app_core_document_export_tests`; `pp_app_core_document_platform_io_tests`; `ctest --preset desktop-fast --build-config Debug`; `powershell -ExecutionPolicy Bypass -File scripts\automation\package-smoke.ps1 -Preset windows-msvc-default -Configuration Debug` | Replace `src/platform_legacy/legacy_platform_services.*` with injected `pp_platform_*` service implementations owned by each non-Windows platform shell |
+| DEBT-0017 | Open | Modernization | Startup storage path preparation, `App::clipboard_get_text`, `App::clipboard_set_text`, `App::show_cursor`, `App::hide_cursor`, `App::showKeyboard`, `App::hideKeyboard`, `App::display_file`, `App::share_file`, native app/window close, UI-thread lifecycle hooks, render-context acquire/release/present hooks, render-target binding hooks, render platform hint hooks, render debug callback hooks, render-capture frame hooks, recording cleanup, live asset/layout reload policy, diagnostic stacktrace/crash hooks, per-frame platform hooks, `App::pick_image`, `App::pick_file`, the non-writer `App::pick_file_save`, `App::pick_dir`, prepared-file save/download handoff, work-directory document export collection policy, and app network TLS verification policy now call the SDK-free `pp::platform::PlatformServices` interface, and Windows injects `WindowsPlatformServices` from `src/platform_windows/windows_platform_services.*`; non-Windows live implementations still use `src/platform_legacy/legacy_platform_services.*`, a named fallback adapter that forwards to retained Apple/Android/Linux/Web bridge functions and retained no-op branches, including the retained Android TLS-verification bypass for current app curl helpers | Preserve behavior while moving platform execution behind a testable service boundary before platform shell implementations are injected | `pp_platform_api_tests`; `pp_app_core_document_export_tests`; `pp_app_core_document_platform_io_tests`; `ctest --preset desktop-fast --build-config Debug`; `powershell -ExecutionPolicy Bypass -File scripts\automation\package-smoke.ps1 -Preset windows-msvc-default -Configuration Debug` | Replace `src/platform_legacy/legacy_platform_services.*` with injected `pp_platform_*` service implementations owned by each non-Windows platform shell |
 | DEBT-0019 | Open | Modernization | Unreferenced-parameter warnings are muted globally through `pp_project_warnings` with MSVC `/wd4100` and Clang/GCC `-Wno-unused-parameter` | Legacy callbacks, virtual hooks, serializer methods, and platform/API compatibility functions carry many intentionally unused parameters during the component split; muting this keeps stricter warning builds focused on higher-signal migration issues | `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset linux-clang --target pp_foundation` | Remove `/wd4100` and `-Wno-unused-parameter`, mark intentionally unused parameters with names/comments or `[[maybe_unused]]`, and make the Windows app plus headless Clang/GCC tests pass without unreferenced-parameter warnings |
 | DEBT-0020 | Open | Modernization | Document resize dialog state, selected-resolution planning, and execution dispatch now consume pure `pp_app_core` through `NodeDialogResize`, `App::dialog_resize`, `pano_cli plan-document-resize`, and the `DocumentResizeServices` boundary, and live resize shares `src/legacy_document_canvas_services.*` with canvas clear commands, but the shared live bridge still calls legacy `Canvas::resize`, updates the legacy app title, and clears legacy `ActionManager` history through the history bridge | Preserve existing layer/frame GPU resize behavior while the document model and canvas execution boundary are extracted incrementally | `pp_app_core_document_resize_tests`; `pano_cli plan-document-resize --current-resolution 2048 --selected-resolution-index 4`; `ctest --preset desktop-fast --build-config Debug` | Document resize execution is owned by injected document/app services with no legacy resize adapter, title shim, or direct `ActionManager` history clearing |
 | DEBT-0021 | Open | Modernization | Layer rename planning/execution dispatch and layer panel operation planning/execution dispatch now consume pure `pp_app_core` through `App::dialog_layer_rename`, `App::init_sidebar` layer callbacks, `pano_cli plan-layer-rename`, `pano_cli plan-layer-operation`, `DocumentLayerRenameServices`, and `DocumentLayerOperationServices`, and the live execution adapters are centralized in `src/legacy_document_layer_services.*`, but that shared bridge still mutates legacy `Canvas` layer state, `NodeLayer`/`NodePanelLayer`, and `ActionManager` undo entries | Preserve existing UI/canvas behavior while document layer commands and undo history are extracted incrementally | `pp_app_core_document_layer_tests`; `pano_cli plan-layer-rename --old-name Base --new-name Paint`; `pano_cli plan-layer-operation --kind add --layer-count 2 --index 1 --name Paint`; `ctest --preset desktop-fast --build-config Debug` | Layer command execution is owned by the document/app command boundary with legacy `Canvas`/UI nodes acting only as adapters or removed entirely |
@@ -55,7 +55,7 @@ agent or engineer to remove them without reconstructing context from chat.
 | DEBT-0035 | Open | Modernization | Main toolbar/status command planning and execution dispatch now consume pure `pp_app_core` through `App::init_toolbar_main`, `pano_cli plan-main-toolbar`, and the `MainToolbarServices` boundary, history/canvas commands now hand off through `HistoryUiServices` and `DocumentCanvasClearServices`, and live execution is centralized in `src/legacy_app_shell_services.*`, but the bridge still opens legacy open/save/settings/message-box dialogs and delegates to legacy history/canvas adapters | Preserve reachable toolbar/status behavior while app shell commands move toward app/document/UI services | `pp_app_core_main_toolbar_tests`; `pano_cli plan-main-toolbar --command undo --undo-count 2`; `pano_cli plan-main-toolbar --command clear-canvas --no-canvas`; `ctest --preset desktop-fast --build-config Debug` | Open/save/settings/message-box routing, undo/redo/clear-history execution, and canvas-clear execution are owned by injected app/document/UI services with `App::init_toolbar_main` acting only as a UI adapter and no legacy toolbar adapter |
 | DEBT-0036 | Open | Modernization | `pp_renderer_api`, `pp_paint_renderer`, `pano_cli plan-paint-feedback`, and `pano_cli plan-stroke-composite` can choose backend-neutral complex paint feedback strategies for fixed-function blending, framebuffer-fetch-capable renderers, or ping-pong render targets. OpenGL extension detection now stores `pp::renderer::RenderDeviceFeatures` through `ShaderManager`, using `pp_renderer_gl::render_device_features` as the backend conversion point. `pp_paint_renderer::plan_canvas_blend_gate` owns the compatibility mapping from persisted layer/brush blend indices to the extracted stroke-composite planner, and live `Canvas::draw_merge` plus `NodeCanvas` panorama rendering both call it with the stored renderer-neutral feature set for their existing shader-blend gates and destination-copy versus framebuffer-fetch decisions. `pp_paint_renderer::plan_canvas_stroke_feedback` also owns the current destination-feedback decision, and live `Canvas::stroke_draw`, thumbnail layer blending, and `NodeStrokePreview` brush-preview rendering use it for framebuffer-fetch versus destination-copy decisions. Actual live stroke rasterization, dual-brush compositing, pattern feedback math, thumbnail layer compositing, and brush-preview compositing still use legacy OpenGL canvas/UI execution | Preserve current painting behavior while the renderer boundary matures for OpenGL parity and later Vulkan/Metal experiments | `pp_renderer_api_tests`; `pp_renderer_gl_capabilities_tests`; `pp_paint_renderer_compositor_tests`; `pano_cli plan-paint-feedback --framebuffer-fetch --explicit-transitions --render-only`; `pano_cli plan-paint-feedback --texture-copy`; `pano_cli plan-stroke-composite --stroke-blend 10 --framebuffer-fetch --explicit-transitions --render-only`; `pano_cli plan-stroke-composite --layer-blend 4 --dual-blend --texture-copy`; `ctest --preset desktop-fast --build-config Debug`; `cmake --build --preset windows-msvc-default --config Debug --target PanoPainter` | Live stroke/layer compositing chooses its feedback path through `pp_paint_renderer` and renderer services, with OpenGL golden parity and Vulkan/Metal lab tests covering framebuffer-fetch and ping-pong behavior |
 | DEBT-0037 | Open | Modernization | Recording lifecycle/export planning and execution dispatch now consume pure `pp_app_core` through `App::rec_start`, `App::rec_stop`, `App::rec_clear`, `App::rec_export`, `pano_cli plan-recording-session`, and the `RecordingServices` boundary; live execution is centralized in `src/legacy_recording_services.*`, but the bridge still owns legacy recording thread startup/shutdown, platform recorded-file cleanup, progress UI, PBO readback through `App::rec_loop`, and `MP4Encoder::write_mp4` execution | Preserve current timelapse/MP4 behavior while recording moves toward app/document/renderer/video services | `pp_app_core_document_recording_tests`; `pano_cli plan-recording-session --running --frame-count 12`; `pano_cli plan-recording-session --platform-clears-files`; `ctest --preset desktop-fast --build-config Debug` | Recording thread lifecycle, frame readback, platform cleanup, progress reporting, and MP4 writing are owned by injected app/renderer/video services with `App` methods acting only as adapters |
-| DEBT-0038 | Open | Modernization | Cloud upload/browse/bulk planning and execution dispatch now consume pure `pp_app_core` through `App::cloud_upload`, `App::cloud_upload_all`, `App::cloud_browse`, `pano_cli plan-cloud-upload`, `pano_cli plan-cloud-upload-all`, `pano_cli plan-cloud-browse`, and the `CloudServices` boundary; live execution is centralized in `src/legacy_cloud_services.*`, but the bridge still uses legacy save-before-upload, `upload`/`download` network helpers, progress/message UI, OpenGL context guarding, `NodeDialogCloud`, `Canvas` project open, layer refresh, and `ActionManager` reset | Preserve current cloud behavior while cloud/network/document import flows move toward app/document/platform services | `pp_app_core_document_cloud_tests`; `pano_cli plan-cloud-upload --new-document --unsaved`; `pano_cli plan-cloud-browse --selected-file demo.ppi`; `pano_cli plan-cloud-upload-all --file-count 3`; `ctest --preset desktop-fast --build-config Debug` | Cloud upload/download, save-before-upload, progress reporting, cloud browse dialog, downloaded project opening, layer refresh, OpenGL context ownership, and action-history reset are owned by injected app/document/network/platform/renderer services with `App` methods acting only as adapters |
+| DEBT-0038 | Open | Modernization | Cloud upload/browse/bulk planning and execution dispatch now consume pure `pp_app_core` through `App::cloud_upload`, `App::cloud_upload_all`, `App::cloud_browse`, `pano_cli plan-cloud-upload`, `pano_cli plan-cloud-upload-all`, `pano_cli plan-cloud-browse`, and the `CloudServices` boundary; live execution is centralized in `src/legacy_cloud_services.*`, and the app-owned `upload`/`download`/license curl helpers now ask `PlatformServices` for the Android TLS-verification bypass policy, but the bridge still uses legacy save-before-upload, app-owned curl helpers instead of an injected network service, progress/message UI, OpenGL context guarding, `NodeDialogCloud`, `Canvas` project open, layer refresh, and `ActionManager` reset | Preserve current cloud behavior while cloud/network/document import flows move toward app/document/platform services | `pp_app_core_document_cloud_tests`; `pp_platform_api_tests`; `pano_cli plan-cloud-upload --new-document --unsaved`; `pano_cli plan-cloud-browse --selected-file demo.ppi`; `pano_cli plan-cloud-upload-all --file-count 3`; `ctest --preset desktop-fast --build-config Debug` | Cloud upload/download, TLS policy, save-before-upload, progress reporting, cloud browse dialog, downloaded project opening, layer refresh, OpenGL context ownership, and action-history reset are owned by injected app/document/network/platform/renderer services with `App` methods acting only as adapters |
 | DEBT-0039 | Open | Modernization | Document-open planning and execution dispatch now consume pure `pp_app_core` through `App::open_document`, `pano_cli plan-open-route`, `DocumentOpenServices`, and `src/legacy_document_open_services.*`, but the bridge still opens ABR/PPBR import prompts before delegating import execution to `src/legacy_brush_package_import_services.*`, applies unsaved-project discard prompts, calls legacy project-open execution, refreshes layer UI, updates the app title, and clears legacy history directly | Preserve current file-open/import behavior while document loading and brush import move toward app/document/asset/UI services | `pp_app_core_document_route_tests`; `pp_app_core_document_session_tests`; `pano_cli plan-open-route --path D:/Paint/Scenes/demo.ppi --unsaved`; `pano_cli plan-open-route --path D:/Paint/Brushes/clouds.ABR --unsaved`; `ctest --preset desktop-fast --build-config Debug` | Brush import prompting, project-open execution, unsaved-project discard prompting, layer refresh, title updates, and history clearing are owned by injected app/document/asset/UI services with `App::open_document` acting only as an adapter |
 | DEBT-0040 | Open | Modernization | Close request, document save, and save-before-workflow planning/execution dispatch now consume pure `pp_app_core` through `App::request_close`, `App::save_document`, `App::continue_document_workflow_after_optional_save`, `pano_cli simulate-app-session`, `DocumentSaveServices`, `CloseRequestServices`, `DocumentWorkflowServices`, and `src/legacy_document_session_services.*`, but the bridge still opens legacy message boxes/save dialogs, calls `Canvas::I->project_save`, mutates the unsaved flag on close confirmation, invokes native app close, and routes save-version through the retained legacy dialog | Preserve current close/save/dirty-workflow behavior while document session execution moves toward app/document/UI/platform services | `pp_app_core_document_session_tests`; `pano_cli simulate-app-session --unsaved --save-intent save-dirty-version`; `pano_cli simulate-app-session --no-canvas`; `pano_cli plan-document-file --work-dir D:/Paint --name demo --target-exists`; `pano_cli plan-document-version --directory D:/Paint --doc-name demo.01 --existing-path D:/Paint/demo.02.ppi`; `ctest --preset desktop-fast --build-config Debug` | Close prompt execution, native close requests, dirty-workflow save prompts, existing-project saves, save dialogs, save-version execution, and unsaved-flag mutation are owned by injected app/document/UI/platform services with `App` methods acting only as adapters |
 | DEBT-0041 | Open | Modernization | Accepted new-document planning/execution dispatch now consumes pure `pp_app_core` through `App::dialog_newdoc`, `pano_cli plan-new-document`, `NewDocumentServices`, and `src/legacy_document_session_services.*`, but the bridge still mutates legacy app document fields, clears legacy layer UI, resizes legacy `Canvas`, clears legacy history, creates the default layer through legacy UI, mutates unsaved/new-document flags, updates the title, and handles keyboard/dialog cleanup directly | Preserve current New Document dialog behavior while document creation moves toward app/document/UI services | `pp_app_core_document_session_tests`; `pano_cli plan-new-document --work-dir D:/Paint --name demo --resolution-index 3`; `pano_cli plan-new-document --work-dir D:/Paint --name demo --resolution-index 3 --target-exists`; `pano_cli simulate-app-session --save-intent save`; `ctest --preset desktop-fast --build-config Debug` | New document creation, overwrite confirmation, canvas/document allocation, default layer creation, history clearing, title updates, dirty/new-document state, and keyboard/dialog cleanup are owned by injected app/document/UI services with `App::dialog_newdoc` acting only as a UI adapter |

docs/modernization/roadmap.md

@@ -655,6 +655,11 @@ pure `pp_app_core` `plan_document_export_collection_target` policy. This
 removes the local iOS branches from those dialogs while preserving iOS
 `work_path/doc_layers` and `work_path/doc_frames` targets in the legacy
 adapter until Apple platform services are injected.
+App-owned curl helpers for download, upload, and license checks now ask
+`PlatformServices` whether network TLS verification is disabled, removing the
+local Android branches from those helpers while preserving Android's existing
+TLS-verification bypass in the legacy adapter until a network/platform service
+owns cloud transport.
 Canvas image export publishing and explicit persistent-storage flushes now
 dispatch through `PlatformServices` too, preserving iOS photo-library export
 publication and WebGL filesystem sync behavior in the legacy adapter while
@@ -766,6 +771,9 @@ the `CloudServices` app-core boundary and `src/legacy_cloud_services.*`, keeping
 `App::cloud_upload`, `App::cloud_upload_all`, and `App::cloud_browse` as thin
 planning adapters while legacy save, progress UI, network, dialog, canvas-open,
 layer-refresh, and action-history work remains tracked under `DEBT-0038`.
+The app-owned curl upload/download/license helpers now consume the platform TLS
+verification policy through `PlatformServices`; retained cloud/network
+execution remains tracked under `DEBT-0038`.
 `pano_cli parse-layout` exercises the XML layout path. Continue expanding
 document behavior toward legacy Canvas parity and then port OpenGL classes
 behind the renderer boundary.
@@ -1711,7 +1719,8 @@ Results:
   storage flush dispatch, document browse-root dispatch,
   native UI/window state save dispatch, prepared-file writable target dispatch,
   prepared-file export-dialog policy dispatch, work-directory document export
-  collection policy dispatch, live asset/layout reload policy dispatch,
+  collection policy dispatch, network TLS verification policy dispatch,
+  live asset/layout reload policy dispatch,
   diagnostic hook dispatch, per-frame platform hook dispatch, picker callback
   dispatch, and prepared-file save/download callback dispatch. The live Windows
   app now

src/app.cpp

@@ -298,9 +298,8 @@ void App::download(std::string url, std::string dest_filepath, std::function<voi
         curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
         curl_easy_setopt(curl, CURLOPT_WRITEDATA, fp);
         curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, curl_data_write);
-#ifdef __ANDROID__
-        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
-#endif
+        if (disables_network_tls_verification())
+            curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
         if (progress)
         {
             curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, progress_callback_download);
@@ -334,9 +333,8 @@ bool App::check_license()
         //curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
         curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, curl_data_handler);
         curl_easy_setopt(curl, CURLOPT_TIMEOUT, 2L);
-#ifdef __ANDROID__
-        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
-#endif
+        if (disables_network_tls_verification())
+            curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
 
         auto err = curl_easy_perform(curl);
         curl_easy_cleanup(curl);
@@ -375,9 +373,8 @@ void App::upload(std::string filename, std::string name, std::function<void(floa
         curl_easy_setopt(curl, CURLOPT_HTTPPOST, formpost);
         curl_easy_setopt(curl, CURLOPT_WRITEDATA, &res);
         curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, curl_data_handler);
-#ifdef __ANDROID__
-        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
-#endif
+        if (disables_network_tls_verification())
+            curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
         if (progress)
         {
             curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, progress_callback_upload);

src/app.h

@@ -186,6 +186,7 @@ public:
     void pick_file_save(std::vector<std::string> types, std::function<void(std::string path)> callback);
     [[nodiscard]] bool uses_prepared_file_writes() const;
     [[nodiscard]] bool uses_work_directory_document_export_collections() const;
+    [[nodiscard]] bool disables_network_tls_verification() const;
     void pick_dir(std::function<void(std::string path)> callback);
     void display_file(std::string path);
     void share_file(std::string path);

src/app_events.cpp

@@ -191,6 +191,11 @@ bool App::uses_work_directory_document_export_collections() const
     return active_platform_services().uses_work_directory_document_export_collections();
 }
 
+bool App::disables_network_tls_verification() const
+{
+    return active_platform_services().disables_network_tls_verification();
+}
+
 void App::pick_dir(std::function<void(std::string path)> callback)
 {
     redraw = true;

src/platform_api/platform_services.h

@@ -65,6 +65,7 @@ public:
     virtual void pick_directory(PickedPathCallback callback) = 0;
     [[nodiscard]] virtual bool uses_prepared_file_writes() = 0;
     [[nodiscard]] virtual bool uses_work_directory_document_export_collections() = 0;
+    [[nodiscard]] virtual bool disables_network_tls_verification() = 0;
     [[nodiscard]] virtual PreparedFileTarget prepare_writable_file(
         std::string_view type,
         std::string_view default_name,

src/platform_legacy/legacy_platform_services.cpp

@@ -449,6 +449,15 @@ public:
 #endif
     }
 
+    [[nodiscard]] bool disables_network_tls_verification() override
+    {
+#ifdef __ANDROID__
+        return true;
+#else
+        return false;
+#endif
+    }
+
     [[nodiscard]] pp::platform::PreparedFileTarget prepare_writable_file(
         std::string_view type,
         std::string_view default_name,

src/platform_windows/windows_platform_services.cpp

@@ -458,6 +458,11 @@ public:
         return false;
     }
 
+    [[nodiscard]] bool disables_network_tls_verification() override
+    {
+        return false;
+    }
+
     [[nodiscard]] pp::platform::PreparedFileTarget prepare_writable_file(
         std::string_view type,
         std::string_view default_name,

tests/platform_api/platform_services_tests.cpp

@@ -222,6 +222,12 @@ public:
         return work_directory_document_export_collections;
     }
 
+    [[nodiscard]] bool disables_network_tls_verification() override
+    {
+        ++network_tls_policy_checks;
+        return network_tls_verification_disabled;
+    }
+
     [[nodiscard]] pp::platform::PreparedFileTarget prepare_writable_file(
         std::string_view type,
         std::string_view default_name,
@@ -283,6 +289,7 @@ public:
     int pick_directory_requests = 0;
     int prepared_file_write_policy_checks = 0;
     int document_export_collection_policy_checks = 0;
+    int network_tls_policy_checks = 0;
     int prepare_writable_file_requests = 0;
     int save_prepared_file_requests = 0;
     bool cursor_visible = false;
@@ -290,6 +297,7 @@ public:
     bool prepared_file_saved = true;
     bool prepared_file_writes = true;
     bool work_directory_document_export_collections = false;
+    bool network_tls_verification_disabled = false;
     bool deletes_recorded_files = true;
     bool live_asset_reloading = true;
     float last_platform_delta = 0.0f;
@@ -616,6 +624,17 @@ void platform_services_dispatch_document_export_collection_policy(pp::tests::Har
     PP_EXPECT(harness, fake.document_export_collection_policy_checks == 2);
 }
 
+void platform_services_dispatch_network_tls_policy(pp::tests::Harness& harness)
+{
+    FakePlatformServices fake("unused");
+    pp::platform::PlatformServices& services = fake;
+
+    PP_EXPECT(harness, !services.disables_network_tls_verification());
+    fake.network_tls_verification_disabled = true;
+    PP_EXPECT(harness, services.disables_network_tls_verification());
+    PP_EXPECT(harness, fake.network_tls_policy_checks == 2);
+}
+
 }
 
 int main()
@@ -642,5 +661,6 @@ int main()
     harness.run(
         "platform services dispatch document export collection policy",
         platform_services_dispatch_document_export_collection_policy);
+    harness.run("platform services dispatch network tls policy", platform_services_dispatch_network_tls_policy);
     return harness.finish();
 }