mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-12 22:26:38 +03:00
bd6964c35b
The engine verified TLS against the Mozilla roots bundled through webpki-roots only, so behind a TLS-inspecting proxy (Aikido, Zscaler, Netskope) whose root lives in the OS trust store, `impeccable update` and `install` failed with `invalid peer certificate: UnknownIssuer` while curl and npm on the same machine succeeded. crates/context/src/http.rs builds one rustls ClientConfig per process: the OS trust store (rustls-native-certs: Keychain, Windows store, the OpenSSL paths on Linux) merged with the bundled roots. A union, not a replacement, so a container without ca-certificates or a store that fails to load still verifies exactly as before. SSL_CERT_FILE and SSL_CERT_DIR replace the OS store the way they do for OpenSSL and curl. Every HTTPS call site (bundle and signature downloads, /api/version, /api/commands, the roll API, image generation) builds its agent from this module; the plain-HTTP live-server calls on localhost are untouched. Verified against a local HTTPS server signed by a throwaway CA: trusted through SSL_CERT_FILE the update check reaches it; without it the same server is rejected as UnknownIssuer; with SSL_CERT_FILE pointing at that CA or at a missing file, impeccable.style still verifies through the bundled roots. cargo test --workspace and the oracle corpus (832) pass. Written with AI assistance (Claude Code). Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
50 lines
1.4 KiB
Rust
50 lines
1.4 KiB
Rust
//! Context and utility verbs: context, doctor, pin, surface-brief,
|
|
//! critique-storage, palette, embed-prompt, signals, detect-csp, concept-seed,
|
|
//! serve-question, generate-image. Each verb is `run(args, io) -> exit code`.
|
|
|
|
pub mod jsp;
|
|
pub mod util;
|
|
pub mod url;
|
|
pub mod http;
|
|
pub mod provider;
|
|
pub mod hook_markers;
|
|
pub mod target_args;
|
|
pub mod target_slug;
|
|
pub mod surface_briefs;
|
|
pub mod artifact_schema;
|
|
pub mod context;
|
|
pub mod staleness;
|
|
pub mod staleness_notice;
|
|
pub mod context_cli;
|
|
pub mod pin;
|
|
pub mod detect_csp;
|
|
|
|
pub use context_cli::run as run_context;
|
|
pub use pin::run as run_pin;
|
|
pub use detect_csp::run as run_detect_csp;
|
|
pub mod palette_data;
|
|
pub mod palette;
|
|
pub use palette::run as run_palette;
|
|
pub mod critique_storage;
|
|
pub mod surface_brief_cli;
|
|
pub use critique_storage::run as run_critique_storage;
|
|
pub use surface_brief_cli::run as run_surface_brief;
|
|
pub mod embed_prompt;
|
|
pub use embed_prompt::run as run_embed_prompt;
|
|
pub mod signals;
|
|
pub use signals::run as run_signals;
|
|
pub mod design_parser;
|
|
pub mod staleness_deep;
|
|
pub mod doctor;
|
|
pub use doctor::run as run_doctor;
|
|
pub mod catalog;
|
|
pub mod roll_selection;
|
|
pub mod seed_text;
|
|
pub mod concept_seed;
|
|
pub use concept_seed::run as run_concept_seed;
|
|
pub mod generate_image;
|
|
pub use generate_image::run as run_generate_image;
|
|
pub mod question_page;
|
|
pub mod serve_question;
|
|
pub use serve_question::run as run_serve_question;
|