edgedb-cli icon indicating copy to clipboard operation
edgedb-cli copied to clipboard

Consider using `rustls-native-certs` for fallback

Open elprans opened this issue 3 years ago • 1 comments

I've built a Docker image containing only the CLI binary and got this:

[I] py: edgedb-pkg /t/d/dockerctx
$ docker run -it --rm edgedb-cli
[2022-11-17T19:06:48Z WARN  edgedb::version_check] Cannot check for updates: failed to fetch JSON at URL: https://packages.edgedb.com/archive/.jsonindexes/x86_64-unknown-linux-musl.nightly.json: error sending request for url (https://packages.edgedb.com/archive/.jsonindexes/x86_64-unknown-linux-musl.nightly.json): error trying to connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1919: (unable to get local issuer certificate): error trying to connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1919: (unable to get local issuer certificate): error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1919: (unable to get local issuer certificate): error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1919:
edgedb error: ClientNoCredentialsError: no `edgedb.toml` found and no connection options are specified
  Hint: Run `edgedb project init` or use any of `-H`, `-P`, `-I` arguments to specify connection parameters. See `--help` for details

Ideally we should fallback to a bundled certificate store if the system store cannot be found. We seem to already depend on rustls-native-certs, so it should be a matter of actually using it.

elprans avatar Nov 17 '22 19:11 elprans

rustls-native-cert is /etc/ssl on linux.

The crate that has certificates is webpki-roots which we depend on in edgedb-rust anyways too.

But the problem is that reqwest has compile-time feature flag to use webpki-roots so it's unclear if we can use that as a fallback without too much issues (i.e. without embedding two versions of reqwest through intermediate crates).

tailhook avatar Nov 21 '22 14:11 tailhook