Verified Commit 7895ee00 authored by Hercules Merscher's avatar Hercules Merscher 🌴
Browse files

fix: Removing custom SSL cert verification from RefResolver

parent 41df049b
Loading
Loading
Loading
Loading
+0 −2
Original line number Diff line number Diff line
@@ -19,7 +19,6 @@ The `RefResolver` solves several key challenges:
- **Remote Schema Resolution**: Automatically fetches and parses external schema definitions over HTTP/HTTPS
- **Performance Optimization**: Caches fetched schemas to avoid redundant network requests
- **Reliability**: Implements configurable timeouts to prevent hanging on slow or unresponsive endpoints
- **Security**: Uses SSL certificate validation with proper certificate store configuration
- **Error Handling**: Provides clear error messages for network failures, timeouts, and invalid JSON responses

## How to Use
@@ -72,5 +71,4 @@ The `RefResolver` is used in the User Experience SLI Registry [lib/labkit/user_e
## Implementation Details

- Only HTTP and HTTPS schemes are supported. Other schemes (FTP, file://, etc.) will raise an error.
- The resolver configures SSL certificate validation using the system's default certificate store with the `PARTIAL_CHAIN` flag, which validates certificate chains and expiration while being more lenient with certain certificate configurations.
- The class-level cache is shared across all instances. In multi-threaded environments, consider using appropriate synchronization mechanisms if cache consistency is critical.
+0 −12
Original line number Diff line number Diff line
@@ -36,7 +36,6 @@ module Labkit
          uri.host,
          uri.port,
          use_ssl: uri.scheme == 'https',
          cert_store: ssl_cert_store,
          open_timeout: @timeout_s,
          read_timeout: @timeout_s
        ) do |http|
@@ -59,17 +58,6 @@ module Labkit
      rescue SocketError, Errno::ECONNREFUSED => e
        raise(JSONSchemer::UnknownRef, "Connection failed for #{uri_str}: #{e.message}")
      end

      def ssl_cert_store
        store = OpenSSL::X509::Store.new
        store.set_default_paths
        # This still validates the certificate chain and expiration,
        # just not explicitly revoked certs
        store.flags = OpenSSL::X509::V_FLAG_PARTIAL_CHAIN
        store
      rescue StandardError
        nil
      end
    end
  end
end