kpumuk opened a new pull request, #3639: URL: https://github.com/apache/thrift/pull/3639
<!-- Explain the changes in the pull request below: --> This updates `Thrift::SSLSocket` to verify peers by default when no SSL context is provided or when the caller supplies a blank `OpenSSL::SSL::SSLContext`. Caller-configured CA files, CA directories, and certificate stores are preserved. When no trust source is configured, the socket uses the system certificate store. Applications that intentionally disable peer identity checks can pass `verify_peer: false` explicitly. This makes `Thrift::SSLSocket` consistent with `Thrift::HTTPClientTransport`, which already enables HTTPS peer verification by default. ## Compatibility This is an intentional Ruby behavior change for 0.25.0. Applications currently relying on connections without peer identity checks must opt out explicitly with `verify_peer: false`. The Ruby README documents the new default and its migration requirements. <!-- We recommend you review the checklist/tips before submitting a pull request. --> - [x] Did you create an [Apache Jira](https://issues.apache.org/jira/projects/THRIFT/issues/) ticket? THRIFT-6098 - [x] If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"? - [x] Did you squash your changes to a single commit? (not required, but preferred) - [x] Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"? - [ ] If your change does not involve any code, include `[skip ci]` anywhere in the commit message to free up build resources. <!-- The Contributing Guide at: https://github.com/apache/thrift/blob/master/CONTRIBUTING.md has more details and tips for committing properly. --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
