(couchdb) branch nouveau-verify-cacertfile-config updated (fe8dc0dd8 -> 20b2d9f12)

[rn...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rnewson pushed a change to branch nouveau-verify-cacertfile-config
in repository https://gitbox.apache.org/repos/asf/couchdb.git


 discard fe8dc0dd8 nouveau: always use cacertfile if specified; explicit peer verification
     new 20b2d9f12 nouveau: always use cacertfile if specified; explicit peer verification

This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version.  This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:

 * -- * -- B -- O -- O -- O   (fe8dc0dd8)
            \
             N -- N -- N   refs/heads/nouveau-verify-cacertfile-config (20b2d9f12)

You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.

Any revisions marked "omit" are not gone; other references still
refer to them.  Any revisions marked "discard" are gone forever.

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 rel/overlay/etc/default.ini | 3 +++
 1 file changed, 3 insertions(+)

(couchdb) 01/01: nouveau: always use cacertfile if specified; explicit peer verification

[rn...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rnewson pushed a commit to branch nouveau-verify-cacertfile-config
in repository https://gitbox.apache.org/repos/asf/couchdb.git

commit 20b2d9f123fb8e7689fc6bfe60f7ad154f7c6426
Author: Robert Newson <rn...@apache.org>
AuthorDate: Mon Jun 29 15:58:17 2026 +0100

    nouveau: always use cacertfile if specified; explicit peer verification
    
    Unless client certificates are used the cacertfile setting is
    ignored. There are legitimate reasons you might want to specify the
    allowed CA certificates without using client certificates, so always
    set this.
    
    Erlang 26 and above uses verify_peer by default but it doesn't hurt to
    be explicit. The new ssl_verify also allowes the ability to disable
    peer verification which might be useful in dev and testing
    environments.
---
 rel/overlay/etc/default.ini     |  3 +++
 src/nouveau/src/nouveau_gun.erl | 19 ++++++++++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/rel/overlay/etc/default.ini b/rel/overlay/etc/default.ini
index aac8ff584..9a50fae46 100644
--- a/rel/overlay/etc/default.ini
+++ b/rel/overlay/etc/default.ini
@@ -1075,6 +1075,9 @@ url = {{nouveau_url}}
 ; Path to file containing CA certificate for the remote nouveau server (optional).
 ;ssl_cacert_file =
 
+; Verify peers
+;ssl_verify = true
+
 [disk_monitor]
 ;enable = false
 ;background_view_indexing_threshold = 80
diff --git a/src/nouveau/src/nouveau_gun.erl b/src/nouveau/src/nouveau_gun.erl
index 75792465b..900d42bd5 100644
--- a/src/nouveau/src/nouveau_gun.erl
+++ b/src/nouveau/src/nouveau_gun.erl
@@ -129,8 +129,16 @@ start_gun(URL) ->
     KeyFile = config:get("nouveau", "ssl_key_file"),
     CertFile = config:get("nouveau", "ssl_cert_file"),
     Password = config:get("nouveau", "ssl_password"),
+    Verify = verify(config:get_boolean("nouveau", "ssl_verify", true)),
     Transport = scheme_to_transport(Scheme),
     BaseConnOptions = #{transport => Transport, protocols => [http2]},
+    BaseTLSOptions =
+        if
+            CACertFile /= undefined ->
+                [{verify, Verify}, {cacertfile, CACertFile}];
+            true ->
+                [{verify, Verify}]
+        end,
     ConnOptions =
         if
             Transport == tls andalso KeyFile /= undefined andalso CertFile /= undefined ->
@@ -142,7 +150,11 @@ start_gun(URL) ->
                 },
                 CertKeyConf1 = maps:filter(fun remove_undefined/2, CertKeyConf0),
                 BaseConnOptions#{
-                    tls_opts => [{certs_keys, [CertKeyConf1]}]
+                    tls_opts => [{certs_keys, [CertKeyConf1]} | BaseTLSOptions]
+                };
+            Transport == tls ->
+                BaseConnOptions#{
+                    tls_opts => BaseTLSOptions
                 };
             true ->
                 BaseConnOptions
@@ -160,3 +172,8 @@ scheme_to_transport("http") ->
     tcp;
 scheme_to_transport("https") ->
     tls.
+
+verify(false) ->
+    verify_none;
+verify(true) ->
+    verify_peer.