v0.45.1: a TLS failure names itself

A TLS failure names itself.

Reported in #90 by a site on a stock two-node PVE 9.2 cluster: Proxmox renewed a node's certificate on its own, the fingerprint pin broke, and every call read ConnectError until they found the new certificate with openssl by hand.

The doctor and every audit row now say which TLS failure it was. A pin mismatch carries both fingerprints, the one the server presents and the one you pinned:

pve: no reach: GET /version failed (ConnectError); TLS pin mismatch: the server presents <sha256>, the pin says <sha256>: re-pin

A certificate that did not verify carries OpenSSL's reason, read from a table of OpenSSL's own strings, never from the exception's text, so no hostname or address the call dialed can reach a row.

New opt-in: trust Proxmox's own cluster CA. Python 3.13 refuses the stock PVE root because it has no keyUsage, which left leaf pins as the only option, and leaf pins break each time Proxmox renews a node certificate. tls_strict = false on a target (or PROXIMO_TLS_STRICT=false, PROXIMO_<P>_TLS_STRICT per plane), with ca_bundle pointed at /etc/pve/pve-root-ca.pem, clears only Python's VERIFY_X509_STRICT for that bundle. The chain and the hostname or IP are still verified. It refuses when there is no CA bundle or a fingerprint is set, and the doctor flags it while it is on.

Tested on real TLS with a root built the way PVE builds it, on Python 3.13 and 3.12. A security lens on the change found the message was withheld by a denylist; it now comes from the table. Also folded: Dependabot #88 (base image digest) and #89 (setup-uv, codeql-action, scorecard-action).

Full history for this release, commit by commit, is on the internal mirror; this
public branch carries one squashed commit per release by design.
Every change here is described in CHANGELOG.md.

Where to read more

• TLS troubleshooting, pins, CA bundles and tls_strict: docs/SETUP.md
• The trust model, and the honest scope notes saying what does not hold: SECURITY.md
• The six tools and their inputs: docs/TOOLS.md
• Verifying the image signature, the SBOM and the provenance yourself: VERIFY.md
• Full change detail: CHANGELOG.md

Install: uvx proximo-proxmox · pip install proximo-proxmox · ghcr.io/john-broadway/proximo:0.45.1