mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-11 13:46:32 +03:00
bd6964c35b
The engine verified TLS against the Mozilla roots bundled through webpki-roots only, so behind a TLS-inspecting proxy (Aikido, Zscaler, Netskope) whose root lives in the OS trust store, `impeccable update` and `install` failed with `invalid peer certificate: UnknownIssuer` while curl and npm on the same machine succeeded. crates/context/src/http.rs builds one rustls ClientConfig per process: the OS trust store (rustls-native-certs: Keychain, Windows store, the OpenSSL paths on Linux) merged with the bundled roots. A union, not a replacement, so a container without ca-certificates or a store that fails to load still verifies exactly as before. SSL_CERT_FILE and SSL_CERT_DIR replace the OS store the way they do for OpenSSL and curl. Every HTTPS call site (bundle and signature downloads, /api/version, /api/commands, the roll API, image generation) builds its agent from this module; the plain-HTTP live-server calls on localhost are untouched. Verified against a local HTTPS server signed by a throwaway CA: trusted through SSL_CERT_FILE the update check reaches it; without it the same server is rejected as UnknownIssuer; with SSL_CERT_FILE pointing at that CA or at a missing file, impeccable.style still verifies through the bundled roots. cargo test --workspace and the oracle corpus (832) pass. Written with AI assistance (Claude Code). Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
28 lines
801 B
TOML
28 lines
801 B
TOML
[package]
|
|
name = "impeccable-context"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
license.workspace = true
|
|
publish.workspace = true
|
|
|
|
[features]
|
|
default = []
|
|
# Use impeccable_core::registry::ANTIPATTERNS for doctor's known rule ids
|
|
# instead of the embedded snapshot in src/rule_ids.rs.
|
|
core-registry = []
|
|
|
|
[dependencies]
|
|
impeccable-common = { workspace = true }
|
|
impeccable-core = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
regex = { workspace = true }
|
|
once_cell = { workspace = true }
|
|
sha2 = "0.10"
|
|
flate2 = { version = "1", default-features = false, features = ["zlib-rs"] }
|
|
ureq = { version = "2", default-features = false, features = ["tls", "json"] }
|
|
rustls-native-certs = "0.8"
|
|
webpki-roots = "1"
|
|
tiny_http = "0.12"
|
|
unicode-normalization = "0.1.25"
|