Re: TLS regression verification for Python client 3.1.0 and Node.js client 1.8.1

2023-02-23 Thread Yunze Xu
Hi Zixuan, This test is to verify if the specific client can avoid configuring the CA file explicitly. From the test results, the Python client works well without setting the file explicitly, while the Node.js client does not. Currently we have already figured out the reason why only the Python c

Re: TLS regression verification for Python client 3.1.0 and Node.js client 1.8.1

2023-02-23 Thread Zixuan Liu
This is not very friendly to explicitly set the ca file. Can we dynamically search the system ca file? and then go to set the ca file to the libcurl. The following are ca files from golang codebase(this is what you mentioned): ``` // Possible certificate files; stop after finding one. var certFi

Re: TLS regression verification for Python client 3.1.0 and Node.js client 1.8.1

2023-02-23 Thread Yunze Xu
I've figured out why the Python client does not suffer from this issue. I use `strace` to print all system calls. Then I find the Python client reads another cert file: ``` openat(AT_FDCWD, "/usr/local/lib/python3.8/dist-packages/certifi/cacert.pem", O_RDONLY) = 6 ``` The correct cert comes from

TLS regression verification for Python client 3.1.0 and Node.js client 1.8.1

2023-02-23 Thread Yunze Xu
Hi all, Currently there are two ongoing releases: Python client 3.1.0 [1] and Node.js client 1.8.1 [2]. Both these two releases depend on the C++ client 3.1.2, which fixes an issue that when performing OAuth2 authentication with an issuer URL whose protocol is HTTPS, users can configure the tls ce