Skip to content

Add global --skip-tls-verify flag for self-signed certs#272

Open
jai-deepsource wants to merge 1 commit intomasterfrom
tls-skip-server
Open

Add global --skip-tls-verify flag for self-signed certs#272
jai-deepsource wants to merge 1 commit intomasterfrom
tls-skip-server

Conversation

@jai-deepsource
Copy link
Contributor

@jai-deepsource jai-deepsource commented Mar 2, 2026

  • Add --skip-tls-verify persistent flag on root command, available to all subcommands
  • Resolution priority: CLI flag > DEEPSOURCE_SKIP_TLS_VERIFY env var > config file
  • Add SkipTLSVerify field to CLIConfig, persisted as skip_tls_verify in TOML
  • Wire all commands (issues, metrics, runs, reportcard, vulnerabilities, auth) to pass resolved value to API client
  • Build custom http.Transport with InsecureSkipVerify when enabled
  • Deprecate report's --skip-verify flag in favor of the global flag
  • Pass SkipTLSVerify through auth service for device registration and PAT requests
  • Add tests for TLS resolution logic, config env/file loading, client transport, and login behavior
  • Remove .deepsource.toml

@jai-deepsource
Add global --skip-tls-verify flag for self-signed certs
09a180e 
- Add --skip-tls-verify persistent flag on root command, available to all subcommands
- Resolution priority: CLI flag > DEEPSOURCE_SKIP_TLS_VERIFY env var > config file
- Add SkipTLSVerify field to CLIConfig, persisted as skip_tls_verify in TOML
- Wire all commands (issues, metrics, runs, reportcard, vulnerabilities, auth) to pass resolved value to API client
- Build custom http.Transport with InsecureSkipVerify when enabled
- Deprecate report's --skip-verify flag in favor of the global flag
- Pass SkipTLSVerify through auth service for device registration and PAT requests
- Add tests for TLS resolution logic, config env/file loading, client transport, and login behavior
- Remove .deepsource.toml
@deepsource-io
Copy link

deepsource-io bot commented Mar 2, 2026 •
edited
Loading

DeepSource Code Review

We reviewed changes in fccfbea...09a180e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade  

Focus Area: Hygiene 		Security  

Reliability  

Complexity  

Hygiene  

Coverage  

Code Review Summary

Analyzer Status Updated (UTC) Details
Go Mar 2, 2026 10:31p.m. Review ↗
Secrets Mar 2, 2026 10:31p.m. Review ↗
Test coverage Mar 2, 2026 10:31p.m. Review ↗

Code Coverage Summary

Language Line Coverage (New Code) Line Coverage (Overall)
Aggregate
27.3%
[⤫ below threshold]
21.6%
[▲ up 2.4% from master]
Go
27.3%
[⤫ below threshold]
21.6%
[▲ up 2.4% from master]
[✓ above threshold]

➟ Additional coverage metrics may have been reported. See full coverage report ↗

deepsource-io[bot]
deepsource-io bot reviewed Mar 2, 2026
View reviewed changes
command/issues/issues.go

func (opts *IssuesOptions) Run(ctx context.Context) error {
client, remote, err := opts.initClientAndConfig()
func (opts *IssuesOptions) Run(cmd *cobra.Command, ctx context.Context) error {
Copy link

@deepsource-io deepsource-io bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

context.Context should be the first parameter of a function


context.Context should be the first parameter of a function.

command/metrics/metrics.go
}

func (opts *MetricsOptions) Run(ctx context.Context) error {
func (opts *MetricsOptions) Run(cmd *cobra.Command, ctx context.Context) error {
Copy link

@deepsource-io deepsource-io bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

context.Context should be the first parameter of a function


context.Context should be the first parameter of a function.

command/reportcard/reportcard.go

func (opts *ReportCardOptions) Run(ctx context.Context) error {
client, remote, err := opts.initClientAndRemote()
func (opts *ReportCardOptions) Run(cmd *cobra.Command, ctx context.Context) error {
Copy link

@deepsource-io deepsource-io bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

context.Context should be the first parameter of a function


context.Context should be the first parameter of a function.

command/runs/runs.go

// runDetail fetches and displays metadata + issues summary for a single commit.
func (opts *RunsOptions) runDetail(ctx context.Context) error {
func (opts *RunsOptions) runDetail(cmd *cobra.Command, ctx context.Context) error {
Copy link

@deepsource-io deepsource-io bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

context.Context should be the first parameter of a function


context.Context should be the first parameter of a function.

command/vulnerabilities/vulnerabilities.go
}

func (opts *VulnerabilitiesOptions) Run(ctx context.Context) error {
func (opts *VulnerabilitiesOptions) Run(cmd *cobra.Command, ctx context.Context) error {
Copy link

@deepsource-io deepsource-io bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

context.Context should be the first parameter of a function


context.Context should be the first parameter of a function.

deepsource/client.go
if cp.InsecureSkipVerify {
base = &http.Transport{
TLSClientConfig: &tls.Config{
InsecureSkipVerify: true, //nolint:gosec // user-requested for self-signed certs
Copy link

@deepsource-io deepsource-io bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TLS InsecureSkipVerify set true.


Insecure configuration of TLS connection settings. Refer to the occurrence to understand the exact misconfiguration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@deepsource-io deepsource-io[bot] deepsource-io[bot] left review comments

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jai-deepsource