Mount romfs before the quiet OTA release check so HTTPS can load cacert.pem.

ota_net_init() now mounts romfs and initializes curl before the GitHub check runs, fixing silent update-check failures after TLS verification was enabled.

native/switch-ota-launcher/README.md

@@ -69,6 +69,6 @@ Manifest: `scripts/switch/ota_launcher.manifest`.
 
 - Zip extraction uses `switch-zziplib` (`ota_unzip.c`) on device.
 - OTA replaces launcher + game from the install zip (NACP versions stay aligned).
-- HTTPS uses Mozilla CA bundle in romfs (`cacert.pem`, fetched at build time).
+- HTTPS uses Mozilla CA bundle in romfs (`cacert.pem`, fetched at build time). `ota_net_init()` mounts romfs before the quiet release check.
 - Sphaira HOME forwarders cache metadata until reinstalled (see docs/switch-install.md).
 - Release runner: `switch-dev` + (`install_devkitpro_deps.sh` **or** Docker)

native/switch-ota-launcher/include/ota_net.h

@@ -10,6 +10,10 @@ extern "C" {
 /* fraction is 0..1 when Content-Length is known, else -1 for indeterminate. */
 typedef void (*ota_net_progress_fn)(void *userdata, double fraction);
 
+/* Mount romfs (CA bundle) and init libcurl. Call before any HTTPS download. */
+int ota_net_init(void);
+void ota_net_shutdown(void);
+
 /* Download URL into memory buffer (caller frees *out). Returns 0 on success. */
 int ota_net_download_buffer(const char *url, long timeout_ms, char **out, size_t *out_len,
                             char *err, size_t err_len);

native/switch-ota-launcher/src/main.c

@@ -232,13 +232,18 @@ int main(int argc, char **argv) {
   (void)argc;
   (void)argv;
 
+  const char *install = SD_INSTALL_DIR;
+
 #if defined(__SWITCH__)
   socketInitializeDefault();
   padConfigureInput(1, HidNpadStyleSet_NpadStandard);
-#endif
-
-  const char *install = SD_INSTALL_DIR;
+  if (ota_net_init() == 0) {
+    run_update_flow(install);
+    ota_net_shutdown();
+  }
+#else
   run_update_flow(install);
+#endif
 
   char game[192];
   snprintf(game, sizeof(game), "%s/%s", install, OTA_GAME_NRO_NAME);

native/switch-ota-launcher/src/ota_net.c

@@ -12,6 +12,31 @@
 #if defined(__SWITCH__)
 #define OTA_CA_BUNDLE "romfs:/cacert.pem"
 
+static int g_net_ready = 0;
+
+static int ota_ca_bundle_ready(void) {
+  FILE *f = fopen(OTA_CA_BUNDLE, "rb");
+  if (!f) return 0;
+  fclose(f);
+  return 1;
+}
+
+int ota_net_init(void) {
+  if (g_net_ready) return 0;
+  if (R_FAILED(romfsInit())) return -1;
+  if (!ota_ca_bundle_ready()) return -1;
+  if (curl_global_init(CURL_GLOBAL_DEFAULT) != CURLE_OK) return -1;
+  g_net_ready = 1;
+  return 0;
+}
+
+void ota_net_shutdown(void) {
+  if (!g_net_ready) return;
+  curl_global_cleanup();
+  romfsExit();
+  g_net_ready = 0;
+}
+
 static void ota_net_configure_tls(CURL *curl) {
   curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
   curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
@@ -60,6 +85,11 @@ static int xfer_progress(void *clientp, curl_off_t dltotal, curl_off_t dlnow, cu
   }
   return 0;
 }
+#else
+
+int ota_net_init(void) { return 0; }
+void ota_net_shutdown(void) {}
+
 #endif
 
 int ota_net_download_buffer(const char *url, long timeout_ms, char **out, size_t *out_len,

native/switch-ota-launcher/src/ota_ui.c

@@ -261,7 +261,7 @@ static void blit_logo(u32 *fb, u32 stride_px, int dst_x, int dst_y, int max_w) {
 
 static void load_logo(void) {
   if (g_logo) return;
-  romfsInit();
+  /* romfs is mounted in ota_net_init() before the release check runs. */
   int w = 0, h = 0, n = 0;
   unsigned char *data = stbi_load("romfs:/logo.png", &w, &h, &n, 4);
   if (!data || w <= 0 || h <= 0) {
@@ -299,7 +299,6 @@ void ota_ui_shutdown(void) {
   free(g_logo);
   g_logo = NULL;
   g_logo_w = g_logo_h = 0;
-  romfsExit();
   g_ready = 0;
 }