An updater inside a desktop app fails with "Update command exited with code 1" while the same update works from a terminal. The command it runs exits with
Error: Could not determine latest pi version: fetch failed (UNABLE_TO_GET_ISSUER_CERT_LOCALLY)
TLS verification fails inside the app and nowhere else. This is pingdotgg/t3code#19604.
Why it happens
An app launched from the dock or the Start menu does not inherit your shell profile's exports. It sees only the desktop session environment, plus whatever the app chooses to import. The desktop app imports a fixed list of variables from the login shell - tool prefixes, data directories - and CA trust variables were not in the list.
The command works in a terminal because the shell profile exports SSL_CERT_FILE. It fails inside the app when the Node on the PATH has no bundled root store - a shared-OpenSSL build - so it needs those variables to find the issuer at all. The same class of failure hits anything else the app spawns that fetches over HTTPS.
The fix
The app now imports SSL_CERT_FILE, SSL_CERT_DIR and NODE_EXTRA_CA_CERTS from the login shell, filling them in only when its own environment has none:
export SSL_CERT_FILE=/path/to/your/ca-bundle.crt
export NODE_EXTRA_CA_CERTS=/path/to/your/ca-bundle.crt
On versions without the fix, launching the app from a terminal is the quickest workaround, because the profile's exports reach it that way.
More generally, if something that runs Node children fails TLS only when launched from the desktop, compare process.env inside the app against your shell before you go hunting for certificate problems.