This is an automated email from the ASF dual-hosted git repository. rnewson pushed a commit to branch nouveau-verify-cacertfile-config in repository https://gitbox.apache.org/repos/asf/couchdb.git
commit fe8dc0dd8dc2632974159124c928ea797319b40b Author: Robert Newson <[email protected]> AuthorDate: Mon Jun 29 15:58:17 2026 +0100 nouveau: always use cacertfile if specified; explicit peer verification Unless client certificates are used the cacertfile setting is ignored. There are legitimate reasons you might want to specify the allowed CA certificates without using client certificates, so always set this. Erlang 26 and above uses verify_peer by default but it doesn't hurt to be explicit. The new ssl_verify also allowes the ability to disable peer verification which might be useful in dev and testing environments. --- src/nouveau/src/nouveau_gun.erl | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/src/nouveau/src/nouveau_gun.erl b/src/nouveau/src/nouveau_gun.erl index 75792465b..900d42bd5 100644 --- a/src/nouveau/src/nouveau_gun.erl +++ b/src/nouveau/src/nouveau_gun.erl @@ -129,8 +129,16 @@ start_gun(URL) -> KeyFile = config:get("nouveau", "ssl_key_file"), CertFile = config:get("nouveau", "ssl_cert_file"), Password = config:get("nouveau", "ssl_password"), + Verify = verify(config:get_boolean("nouveau", "ssl_verify", true)), Transport = scheme_to_transport(Scheme), BaseConnOptions = #{transport => Transport, protocols => [http2]}, + BaseTLSOptions = + if + CACertFile /= undefined -> + [{verify, Verify}, {cacertfile, CACertFile}]; + true -> + [{verify, Verify}] + end, ConnOptions = if Transport == tls andalso KeyFile /= undefined andalso CertFile /= undefined -> @@ -142,7 +150,11 @@ start_gun(URL) -> }, CertKeyConf1 = maps:filter(fun remove_undefined/2, CertKeyConf0), BaseConnOptions#{ - tls_opts => [{certs_keys, [CertKeyConf1]}] + tls_opts => [{certs_keys, [CertKeyConf1]} | BaseTLSOptions] + }; + Transport == tls -> + BaseConnOptions#{ + tls_opts => BaseTLSOptions }; true -> BaseConnOptions @@ -160,3 +172,8 @@ scheme_to_transport("http") -> tcp; scheme_to_transport("https") -> tls. + +verify(false) -> + verify_none; +verify(true) -> + verify_peer.
