From 9101eef9f20f0cde24d76ecd0ce969ffade03421 Mon Sep 17 00:00:00 2001 From: aniket866 Date: Sat, 31 Oct 2026 01:38:57 +0530 Subject: [PATCH] fix: handle TLSExplicit bool field Signed-off-by: aniket866 --- cmd/login.go | 6 ++++-- pkg/config/localconfig.go | 1 + pkg/connectors/microcks_client.go | 23 +++++++++++++++++++++-- 3 files changed, 26 insertions(+), 4 deletions(-) diff --git a/cmd/login.go b/cmd/login.go index a68a437c..86429a5b 100644 --- a/cmd/login.go +++ b/cmd/login.go @@ -127,7 +127,8 @@ microcks login http://localhost:8080 --sso --sso-launch-browser=false if keycloakUrl == "null" { localConfig.UpsertServer(config.Server{ Server: server, - InsecureTLS: true, + InsecureTLS: globalClientOpts.InsecureTLS, + TLSExplicit: true, KeycloakEnable: false, }) fmt.Print("No login required...\n") @@ -178,7 +179,8 @@ microcks login http://localhost:8080 --sso --sso-launch-browser=false localConfig.UpsertServer(config.Server{ Server: server, - InsecureTLS: true, + InsecureTLS: globalClientOpts.InsecureTLS, + TLSExplicit: true, KeycloakEnable: true, }) } diff --git a/pkg/config/localconfig.go b/pkg/config/localconfig.go index ac7dd870..4d453749 100644 --- a/pkg/config/localconfig.go +++ b/pkg/config/localconfig.go @@ -58,6 +58,7 @@ type Server struct { Name string `yaml:"name"` Server string `yaml:"server"` InsecureTLS bool `yaml:"insecureTLS"` + TLSExplicit bool `yaml:"tlsExplicit,omitempty"` KeycloakEnable bool `yaml:"keycloakEnable"` } diff --git a/pkg/connectors/microcks_client.go b/pkg/connectors/microcks_client.go index f017ff10..f8afb244 100644 --- a/pkg/connectors/microcks_client.go +++ b/pkg/connectors/microcks_client.go @@ -200,7 +200,17 @@ func NewClient(opts ClientOptions) (MicrocksClient, error) { } c.ServerAddr = configCtx.Server.Server - c.InsecureTLS = configCtx.Server.InsecureTLS + // Honor the persisted insecureTLS only when it was written by the new + // login (TLSExplicit == true). Old login always wrote insecureTLS: true + // even without --insecure-tls, so we must not blindly trust it. + if configCtx.Server.TLSExplicit { + c.InsecureTLS = configCtx.Server.InsecureTLS + } else if configCtx.Server.InsecureTLS { + // Legacy config: insecureTLS was set unconditionally by older login. + // Warn the user and keep TLS verification enabled for safety. + log.Printf("Warning: saved context %q has insecureTLS: true but was written by an older microcks-cli that always persisted that value. TLS certificate verification will be enforced. Re-run 'microcks login' with --insecure-tls if needed.\n", configCtx.Name) + c.InsecureTLS = false + } c.AuthToken = configCtx.User.AuthToken c.RefreshToken = configCtx.User.RefreshToken @@ -226,8 +236,17 @@ func NewClient(opts ClientOptions) (MicrocksClient, error) { c.Verbose = opts.Verbose } - if config.InsecureTLS || len(config.CaCertPaths) > 0 { + // Build the HTTP transport. config.InsecureTLS is set by the --insecure-tls + // CLI flag and always takes precedence. c.InsecureTLS comes from the saved + // context and is honoured only when it was written by the new login code + // (TLSExplicit == true in the stored Server entry). + effectiveInsecure := config.InsecureTLS || c.InsecureTLS + if effectiveInsecure || len(config.CaCertPaths) > 0 { + // Temporarily set the global flag so CreateTLSConfig picks it up. + prevInsecure := config.InsecureTLS + config.InsecureTLS = effectiveInsecure tlsConfig := config.CreateTLSConfig() + config.InsecureTLS = prevInsecure tr := &http.Transport{ TLSClientConfig: tlsConfig, }