Re: TLS regression verification for Python client 3.1.0 and Node.js client 1.8.1

2023-02-23 Thread Yunze Xu
Hi Zixuan, This test is to verify if the specific client can avoid configuring the CA file explicitly. From the test results, the Python client works well without setting the file explicitly, while the Node.js client does not. Currently we have already figured out the reason why only the Python c

Re: TLS regression verification for Python client 3.1.0 and Node.js client 1.8.1

2023-02-23 Thread Zixuan Liu
This is not very friendly to explicitly set the ca file. Can we dynamically search the system ca file? and then go to set the ca file to the libcurl. The following are ca files from golang codebase(this is what you mentioned): ``` // Possible certificate files; stop after finding one. var certFi

Re: TLS regression verification for Python client 3.1.0 and Node.js client 1.8.1

2023-02-23 Thread Yunze Xu
I've figured out why the Python client does not suffer from this issue. I use `strace` to print all system calls. Then I find the Python client reads another cert file: ``` openat(AT_FDCWD, "/usr/local/lib/python3.8/dist-packages/certifi/cacert.pem", O_RDONLY) = 6 ``` The correct cert comes from