Documentation
¶
Overview ¶
Package tlsprobe runs a handshake-only TLS dial against a host so callers (currently `bitbottle auth login`) can decide whether the host's certificate chains to a CA the OS already trusts. When the handshake fails specifically because of an unknown authority, the probe re-dials with InsecureSkipVerify and captures the leaf certificate — that cert is what the caller renders to the user so they can decide whether to trust it (SSH known-hosts UX).
Network-class errors (DNS failure, connection refused, timeout) are returned as errors, not Results — the caller is then free to let the normal request path surface them with the usual error catalogue.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Options ¶
type Options struct {
// RootCAs overrides the system trust store. Tests use this to
// distinguish "trusted CA" from "self-signed" without touching the
// real OS keychain.
RootCAs *x509.CertPool
// Timeout caps the entire handshake. Zero → 10s.
Timeout time.Duration
}
Options carry the knobs that tests need to override. Production callers pass the zero value to get sensible defaults.
type Result ¶
type Result struct {
// TrustedByOS is true when the host's certificate chain verified
// against the system trust store (or the override pool when
// Options.RootCAs is non-nil). In that case LeafCert is nil — there
// is nothing for the user to decide.
TrustedByOS bool
// LeafCert is populated only when TrustedByOS is false. It is the
// leaf certificate returned by the server during the second,
// InsecureSkipVerify dial — the cert the user would be trusting if
// they confirmed.
LeafCert *x509.Certificate
// FingerprintSHA256 is the hex-encoded SHA-256 of LeafCert.Raw
// (the DER-encoded certificate). Empty when LeafCert is nil. Use
// this when printing to the user; it's the same value GitHub and
// SSH known-hosts surface.
FingerprintSHA256 string
}
Result describes the outcome of a successful or self-signed probe. A nil Result means the probe could not even reach the host (the returned error carries the network-class reason).
func Probe ¶
Probe performs a TLS handshake against host (which must already include a port, e.g. "git.example.com:443"). If host has no port the probe defaults to :443. The returned Result describes whether the OS trusted the chain. Network and context-cancellation errors short-circuit and are returned as errors.
Source Files