Finding 1 of the review of 30cefd1b. `--key-origin` anchored an https origin over
plain HTTP, an origin with no port could not be anchored, and `--connect` let any
server stand in for the origin with the output unchanged.
- The CLI retrieves the key log over TLS itself (feature `cli_tls`, which only the
binary uses): rustls with the ring provider already in the graph, and
rustls-platform-verifier for the operating system's trust store. TLS to the
origin's host and port (443 by default), SNI and certificate validation for that
host, `Cache-Control: no-cache`, no redirect followed; the Retrieval built only
from that request and its response. A response's end must be authenticated
(close_notify) or framed (Content-Length, chunked).
- Without `cli_tls`, the CLI refuses to anchor (key_log_not_from_origin, "no TLS")
and connects to nothing.
- `--connect` is gone; `--test-plaintext-connect` is a test aid whose anchor is
labelled `test-plaintext` (relied_on false, "anchors nothing a verifier may rely
on"), never `fetched`, and the command exits 1.
- Tests: the binary's own TLS tests against servers under a test CA
(tests/fixtures/tls/, test keys): an anchor from a TLS retrieval with the SNI,
Host and no-cache seen by the server; another host's certificate, a plaintext
server (never sent a plaintext request), a redirect and an unauthenticated end
each anchor nothing; the origin parser. cli_http: the test anchor labelled as
such, and a plaintext server at the origin's address never asked in plaintext,
with and without cli_tls (CI runs both).
- §8.4: a retrieval is an https retrieval the verifier made itself.
- Licences: wai-rs gains deny.toml (wai-pack's allow-list, over the binary's
features on its host targets), checked in the wai-pack licences job; wai-pack's
lock is unchanged by this.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
4f49593b73