4f49593b73
Finding 1 of the review of 30cefd1b. `--key-origin` anchored an https origin over
plain HTTP, an origin with no port could not be anchored, and `--connect` let any
server stand in for the origin with the output unchanged.
- The CLI retrieves the key log over TLS itself (feature `cli_tls`, which only the
binary uses): rustls with the ring provider already in the graph, and
rustls-platform-verifier for the operating system's trust store. TLS to the
origin's host and port (443 by default), SNI and certificate validation for that
host, `Cache-Control: no-cache`, no redirect followed; the Retrieval built only
from that request and its response. A response's end must be authenticated
(close_notify) or framed (Content-Length, chunked).
- Without `cli_tls`, the CLI refuses to anchor (key_log_not_from_origin, "no TLS")
and connects to nothing.
- `--connect` is gone; `--test-plaintext-connect` is a test aid whose anchor is
labelled `test-plaintext` (relied_on false, "anchors nothing a verifier may rely
on"), never `fetched`, and the command exits 1.
- Tests: the binary's own TLS tests against servers under a test CA
(tests/fixtures/tls/, test keys): an anchor from a TLS retrieval with the SNI,
Host and no-cache seen by the server; another host's certificate, a plaintext
server (never sent a plaintext request), a redirect and an unauthenticated end
each anchor nothing; the origin parser. cli_http: the test anchor labelled as
such, and a plaintext server at the origin's address never asked in plaintext,
with and without cli_tls (CI runs both).
- §8.4: a retrieval is an https retrieval the verifier made itself.
- Licences: wai-rs gains deny.toml (wai-pack's allow-list, over the binary's
features on its host targets), checked in the wai-pack licences job; wai-pack's
lock is unchanged by this.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
43 lines
1.4 KiB
TOML
43 lines
1.4 KiB
TOML
# The licences the `wai` binary's HTTP commands may carry with their TLS client (the
|
|
# `cli_tls` feature: rustls and the operating system's trust store), checked in CI beside
|
|
# wai-pack's (.github/workflows/wai-pack.yml, job `licences`), under the same allow-list.
|
|
#
|
|
# The graph is the binary's HTTP features on the hosts it is built for. The library's
|
|
# other features reach the check through wai-pack's graph. rustls-platform-verifier's
|
|
# wasm32 and Android dependencies are not in it: no wasm32 or Android build enables
|
|
# `cli_tls`, and on wasm32 the library opens no connection at all.
|
|
|
|
[graph]
|
|
no-default-features = true
|
|
features = ["http", "video_manifest", "key_discovery", "cli_tls"]
|
|
targets = [
|
|
"aarch64-apple-darwin",
|
|
"x86_64-apple-darwin",
|
|
"x86_64-unknown-linux-gnu",
|
|
"aarch64-unknown-linux-gnu",
|
|
"x86_64-pc-windows-msvc",
|
|
]
|
|
|
|
[licenses]
|
|
allow = [
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"MIT",
|
|
"MIT-0",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Zlib",
|
|
"CC0-1.0",
|
|
"Unicode-3.0",
|
|
"Unlicense",
|
|
]
|
|
confidence-threshold = 0.9
|
|
unused-allowed-license = "allow"
|
|
|
|
# wai's build script generates its C header with cbindgen, a build-time tool: it is not
|
|
# linked into the binary, and its output is not covered by its licence. As in wai-pack's
|
|
# deny.toml, the exception names the version reviewed.
|
|
[[licenses.exceptions]]
|
|
crate = "[email protected]"
|
|
allow = ["MPL-2.0"]
|