ss-tools

Author SHA1 Message Date

Author	SHA1	Message	Date
busya	18b9f2e94e	fix(certs): restore HTTP CA auto-download and test edge matrix Restore LLM_CA_CERT_URLS support for corporate PKI HTTP cert delivery. Downloaded certificates are installed into the llm/ CA category and share the same system trust + NSS import path as CERTS_PATH-mounted certs. Changes: - certs.sh: add download_llm_ca_certs with HTTP-only curl policy, PEM/DER handling, retries, llm/ storage, hash symlinks for llm+custom - backend/agent entrypoints: run download before install_all_certs - compose/env/docs: expose LLM_CA_CERT_URLS again and update ADR-0009 - integration tests: cover PEM/DER/CER, invalid certs, non-HTTP skips, query-string filenames, private/server skips, empty inputs, combined LLM_CA_CERT_URLS + CERTS_PATH channels, and NSS imports Verified: - 194 passed, 1 skipped integration tests - full backend container smoke passed with testcontainers PostgreSQL - docker bundle rebuilt for 0.5.0	2026-07-07 10:23:49 +03:00
busya	1e61f098bd	fix(docker): add missing certs.sh COPY to backend/all-in-one Dockerfile Backend entrypoint sources certs.sh for CA certificate installation, but the file was never copied into the Docker image — causing container crash loop on startup (regression in `8fd23f7e`). Changes: - docker/backend.Dockerfile, docker/all-in-one.Dockerfile: COPY certs.sh - docker/backend.entrypoint.sh: remove dead install_llm_ca_certs, install_certificates (replaced by docker/certs.sh); update @INVARIANT - backend/src/core/ssl.py: fix describe_context() to report actual system cert count (SSLContext.capath attr does not exist in Python 3) - __tests__: rewrite stale tests asserting LLM_SSL_VERIFY=false → verify=False; behaviour is permanently removed — always CERT_REQUIRED - backend/tests/integration/test_backend_container.py [new]: 5 tests verifying certs.sh presence, sourceability, and full-stack smoke (testcontainers PG → entrypoint → migrations → health) - conftest.py: restore health-wait loop and fixtures in superset_container - ADR-0009, README.md, scripts, .env: align docs with centralized SSL	2026-07-07 00:58:41 +03:00

busya

18b9f2e94e

fix(certs): restore HTTP CA auto-download and test edge matrix

Restore LLM_CA_CERT_URLS support for corporate PKI HTTP cert delivery.
Downloaded certificates are installed into the llm/ CA category and share
the same system trust + NSS import path as CERTS_PATH-mounted certs.

Changes:
- certs.sh: add download_llm_ca_certs with HTTP-only curl policy,
  PEM/DER handling, retries, llm/ storage, hash symlinks for llm+custom
- backend/agent entrypoints: run download before install_all_certs
- compose/env/docs: expose LLM_CA_CERT_URLS again and update ADR-0009
- integration tests: cover PEM/DER/CER, invalid certs, non-HTTP skips,
  query-string filenames, private/server skips, empty inputs, combined
  LLM_CA_CERT_URLS + CERTS_PATH channels, and NSS imports

Verified:
- 194 passed, 1 skipped integration tests
- full backend container smoke passed with testcontainers PostgreSQL
- docker bundle rebuilt for 0.5.0

2026-07-07 10:23:49 +03:00

busya

1e61f098bd

fix(docker): add missing certs.sh COPY to backend/all-in-one Dockerfile

Backend entrypoint sources certs.sh for CA certificate installation,
but the file was never copied into the Docker image — causing
container crash loop on startup (regression in 8fd23f7e).

Changes:
- docker/backend.Dockerfile, docker/all-in-one.Dockerfile: COPY certs.sh
- docker/backend.entrypoint.sh: remove dead install_llm_ca_certs,
  install_certificates (replaced by docker/certs.sh); update @INVARIANT
- backend/src/core/ssl.py: fix describe_context() to report actual
  system cert count (SSLContext.capath attr does not exist in Python 3)
- __tests__: rewrite stale tests asserting LLM_SSL_VERIFY=false →
  verify=False; behaviour is permanently removed — always CERT_REQUIRED
- backend/tests/integration/test_backend_container.py [new]: 5 tests
  verifying certs.sh presence, sourceability, and full-stack smoke
  (testcontainers PG → entrypoint → migrations → health)
- conftest.py: restore health-wait loop and fixtures in superset_container
- ADR-0009, README.md, scripts, .env: align docs with centralized SSL

2026-07-07 00:58:41 +03:00

2 Commits