Skip to content

v1.12.3 — Outbound-TLS trust (LDAP verify · custom-CA · proxy egress)

Choose a tag to compare

View all tags
@clem-field clem-field released this 20 Jul 23:49
v1.12.3
This tag was signed with the committer’s verified signature.
clem-field
GPG key ID: 6BAB1F98BE4CFE69
Verified
Learn about vigilant mode.
d4990dc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Outbound-TLS trust cluster — SPARC can now be deployed in a locked-down enterprise or DoD environment (private CAs, a mandated TLS egress proxy, a verified LDAPS directory) without weakening any verification. Closes the three gaps found by the v1.12.2 outbound-TLS audit.

Highlights

LDAP verifies the directory server certificate (#773)

simple_tls/start_tls previously encrypted the channel but never authenticated the directory server's cert (net-ldap defaults to VERIFY_NONE when tls_options is omitted) — leaving LDAP bind credentials MITM-open. LDAP now verifies with VERIFY_PEER by default. Supply the directory CA via SPARC_LDAP_CA_FILE or the container trust store; SPARC_LDAP_TLS_VERIFY=false is an env-gated, loudly-logged opt-out for legacy internal directories.

Custom / private-CA trust for the container (#774)

Two ways to trust a private, corporate-proxy, or DoD-PKI CA, both folding into the OpenSSL trust store so every outbound client benefits (Net::HTTP, RestClient, AWS SDK, and the LDAP default store):

  • Runtime, no rebuild: mount CAs and point SPARC_EXTRA_CA_CERTS at them (default /rails/certs); the entrypoint appends them to the system bundle and exports SSL_CERT_FILE as the non-root runtime user (public CAs stay trusted).
  • Build-time bake-in: drop PEMs into certs/ → update-ca-trust. For locked-down / air-gapped image builds.

Outbound HTTP honors the egress proxy (#775)

Ruby's Net::HTTP :ENV default reads http_proxy only and ignores https_proxy for every scheme — so a deployment setting the conventional HTTPS_PROXY had all of SPARC's (HTTPS) egress bypass the proxy. Outbound HTTP is now centralized through SparcHttp, routing via URI#find_proxy — scheme-strict (https→https_proxy), NO_PROXY-aware, VERIFY_PEER.

Together, #774 + #775 support an operator-sanctioned TLS-inspecting egress proxy or private PKI without ever disabling verification: SPARC still verifies every connection, but against a CA the operator explicitly installed — an untrusted interceptor is still rejected.

Also included

  • Fail-closed TLS check (tests/ui-smoke/test_tls_verification.py): asserts an untrusted cert is rejected when verification is on (not just that a valid one is accepted).
  • ui-smoke harness now honors the TLS-verify mode across all transports (enables release-grade smoke against the local prod image over self-signed TLS).

Upgrade notes

  • LDAP (#773) — breaking: deployments using start_tls/simple_tls with a self-signed / private directory cert must now add the CA (SPARC_LDAP_CA_FILE or the #774 container trust) or set SPARC_LDAP_TLS_VERIFY=false (insecure). No change for LDAPS with a publicly-trusted cert.
  • Proxy (#775): if you relied on http_proxy covering HTTPS egress, also set HTTPS_PROXY (now honored scheme-strictly).
  • New env vars: SPARC_EXTRA_CA_CERTS, SPARC_LDAP_CA_FILE, SPARC_LDAP_TLS_VERIFY, plus HTTPS_PROXY/HTTP_PROXY/NO_PROXY (now honored). No migration required.

Full changelog: v1.12.2...v1.12.3

Assets 2
Loading