Repository navigation
feat(hairpin): trust a CA file; re-pin hairpin and camber to http 0.36.0.0 - #507
Merged
Merged
Conversation
…6.0.0 Hairpin.ca(c, path) sets a PEM CA file that requests and streams trust in place of the default store. hairpin/ca-check.sh checks it against a private-CA server on both lanes. hairpin 0.9.0.0 and camber 0.12.0.0 import [email protected]. Their importers re-pin after both publish; pins.allow lets the old pins through until then. Refs #501
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First wave of #501. Hairpin and camber move to
[email protected], and Hairpin gains a CA setting.Hairpin CA file
Hairpin.ca(c, path)sets a PEM CA file. Requests (Http.Hops.ca) and streams (Http.StreamHops.ca) trust it in place of the default store."", the default, keeps the default store. Like the client certificate, the file follows same-origin redirects only; http enforces that.Optsgains acafield. Onlyhairpin.bendbuildsOpts, so no caller changes.Versions
Camber's own examples that import
[email protected]from the hub (users*.bend,bench/public_*,deploy/users.bend) stay on http 0.35.0.0 until camber 0.12.0.0 publishes. Mixing those pins would mix twoHttptype sets.scripts/pins.allowlets[email protected],[email protected], and[email protected]through until the second wave. That wave re-pins jwt, llm, oauth2, sigv4, webhooks, gateway, authz, runner, and the camber examples, drops the three lines, and closes #501.Verification
hairpin/ca-check.sh(native) andhairpin/ca-check.sh js: a request and a stream, each through a redirect, reach a private-CA server withHairpin.ca, and fail withErrTlscode 100 without it. Both lanes pass.scripts/check.sh hairpinandscripts/check.sh camberpass.scripts/pins.shandscripts/publish.sh --check hairpin camberpass.Refs #501