mirror of
https://github.com/lexmount/moli.git
synced 2026-09-28 08:01:37 +00:00
ldm0
2d5b88b3dc
Pin the curl-rust build that enables libcurl's Apple SecTrust verifier with the existing AWS-LC TLS backend. Leave default CA options unset so macOS trust comes from the operating system rather than an automatically discovered certificate file. Preserve explicit CA files and certificate environment overrides for origins and HTTPS proxies, including explicit-file precedence over SSL_CERT_DIR. Keep other platforms' existing trust configuration. Add macos-latest CI coverage for local HTTPS, WSS, and HTTPS proxy handshakes, including native-verifier diagnostics, rejected certificates and hostnames, and CA overrides. Use distinct CA and server identities, blocking accepted sockets, and bounded fixture commands. Exercise the generated chains, nonblocking socket transition, and process deadlines in portable regression tests. Validated on Linux with cargo fmt --all, workspace Clippy with all targets and features, and cargo nextest run --no-fail-fast: 18447 passed, 14 skipped. macOS-specific checks run in CI. Refs #701
42 lines
1.2 KiB
YAML
42 lines
1.2 KiB
YAML
name: macOS TLS trust
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- Cargo.toml
|
|
- Cargo.lock
|
|
- rust-toolchain
|
|
- moli-curl/**
|
|
- .github/workflows/macos-tls.yml
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: macos-tls-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
sectrust:
|
|
name: SecTrust
|
|
runs-on: macos-latest
|
|
timeout-minutes: 25
|
|
env:
|
|
MACOSX_DEPLOYMENT_TARGET: "13.0"
|
|
CARGO_INCREMENTAL: "0"
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
- name: Install pinned Rust toolchain
|
|
run: |
|
|
toolchain=$(tr -d '[:space:]' < rust-toolchain)
|
|
rustup toolchain install "$toolchain" --profile minimal --component clippy --no-self-update
|
|
- name: Check macOS code
|
|
run: cargo clippy --locked -p moli-curl --all-targets -- -D warnings
|
|
- name: Test HTTP and WebSocket runtime
|
|
run: cargo test --locked -p moli-curl
|
|
- name: Test native trust and explicit CA overrides
|
|
run: cargo test --locked -p moli-curl --test apple_sectrust -- --ignored --nocapture
|