edgedb / edgedb-cli

The EdgeDB CLI
https://www.edgedb.com/docs/cli/index
Apache License 2.0
167 stars 23 forks source link

Consider using `rustls-native-certs` for fallback #889

Open elprans opened 2 years ago

elprans commented 2 years ago

I've built a Docker image containing only the CLI binary and got this:

[I] py: edgedb-pkg /t/d/dockerctx
$ docker run -it --rm edgedb-cli
[2022-11-17T19:06:48Z WARN  edgedb::version_check] Cannot check for updates: failed to fetch JSON at URL: https://packages.edgedb.com/archive/.jsonindexes/x86_64-unknown-linux-musl.nightly.json: error sending request for url (https://packages.edgedb.com/archive/.jsonindexes/x86_64-unknown-linux-musl.nightly.json): error trying to connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1919: (unable to get local issuer certificate): error trying to connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1919: (unable to get local issuer certificate): error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1919: (unable to get local issuer certificate): error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1919:
edgedb error: ClientNoCredentialsError: no `edgedb.toml` found and no connection options are specified
  Hint: Run `edgedb project init` or use any of `-H`, `-P`, `-I` arguments to specify connection parameters. See `--help` for details

Ideally we should fallback to a bundled certificate store if the system store cannot be found. We seem to already depend on rustls-native-certs, so it should be a matter of actually using it.

tailhook commented 2 years ago

rustls-native-cert is /etc/ssl on linux.

The crate that has certificates is webpki-roots which we depend on in edgedb-rust anyways too.

But the problem is that reqwest has compile-time feature flag to use webpki-roots so it's unclear if we can use that as a fallback without too much issues (i.e. without embedding two versions of reqwest through intermediate crates).