legion-crypt 1.5.7 → 1.5.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3b695e8ac3853b730218da5e1b40b9f7bdc9c7fbffbd1ec4eddccd5539fe296a
-  data.tar.gz: 544bf702cdcc9114b7fa0b99c14141fa6f58b37ee9dbde767e953076ffaedb4c
+  metadata.gz: b2c9243c14fe8bce1a6abb0de6a29681b08b8c8719ff592f2191581209131a38
+  data.tar.gz: 3880aee6fb5c3c82606317dd82c80f64f3f3a84c984c72fcd23402a263f262a6
 SHA512:
-  metadata.gz: dcf4c2dd40eeb403ec1708be60992abf7970d73e1f084f84cd840c4a1718c70497cee70a6bfe5b3d402852a9289f8498a3afbc23973a557e3f1cca355d2fefbe
-  data.tar.gz: a90c05a4b59d770f8cd0276008e9454e15e966e570ebf0248f8d5bb8fa48c67120c91d357e8b7225d14ec98547c41cc2914c130a65022e416e6739e489d4c526
+  metadata.gz: 1001efcac237f95827a8784886050e5047afca4830eec8cc962cf72e119c875694477c3dddad011c56dd643bdf42aab8eab8e4a027afda303ddf306c03eea7de
+  data.tar.gz: fcb5bf8a7527a65221bd917ee1574ce633609f60d00dd070135e4316f05b6c5f0b95ddf251544230e3cf7d0740aa9fa2ea1f4975c638b8e440e50fa282ff5d6c

data/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [1.5.8] - 2026-04-09
+
+### Added
+- Configurable SSL verification for Vault connections via `crypt.vault.tls.verify` setting (`peer`/`none`/`mutual`, defaults to `peer`)
+- Global Vault client (`vault.rb`) now sets `::Vault.ssl_verify` from `vault.tls.verify` setting
+- Per-cluster Vault clients (`vault_cluster.rb`) now pass `ssl_verify:` to `::Vault::Client.new` from `config[:tls][:verify]`
+- JWKS client (`jwks_client.rb`) now sets `Net::HTTP#verify_mode` from `crypt.jwt.jwks_tls_verify` setting (`peer`/`none`, defaults to `peer`)
+- `jwks_tls_verify: 'peer'` default added to JWT settings
+- `tls: { verify: 'peer' }` default added to Vault settings
+
 ## [1.5.7] - 2026-04-08
 
 ### Fixed

data/lib/legion/crypt/jwks_client.rb

@@ -112,7 +112,8 @@ module Legion
           raise Legion::Crypt::JWT::Error, 'failed to fetch JWKS: HTTPS is required' unless uri.scheme == 'https'
 
           http = Net::HTTP.new(uri.host, uri.port)
-          http.use_ssl = uri.scheme == 'https'
+          http.use_ssl = true
+          http.verify_mode = jwks_ssl_verify_mode
           http.open_timeout = 10
           http.read_timeout = 10
 
@@ -158,6 +159,15 @@ module Legion
           keys
         end
 
+        def jwks_ssl_verify_mode
+          return OpenSSL::SSL::VERIFY_PEER unless defined?(Legion::Settings)
+
+          verify = Legion::Settings[:crypt][:jwt][:jwks_tls_verify]&.to_s
+          verify == 'none' ? OpenSSL::SSL::VERIFY_NONE : OpenSSL::SSL::VERIFY_PEER
+        rescue StandardError
+          OpenSSL::SSL::VERIFY_PEER
+        end
+
         def with_url_lock(jwks_url, &)
           lock = @locks_mutex.synchronize { @locks[jwks_url] ||= Mutex.new }
           lock.synchronize(&)

data/lib/legion/crypt/settings.rb

@@ -48,7 +48,8 @@ module Legion
           default_ttl:       3600,
           issuer:            'legion',
           verify_expiration: true,
-          verify_issuer:     true
+          verify_issuer:     true,
+          jwks_tls_verify:   'peer'
         }
       end
 
@@ -72,6 +73,9 @@ module Legion
             service_principal: nil,
             auth_path:         'auth/kerberos/login'
           },
+          tls:                 {
+            verify: 'peer'
+          },
           clusters:            {},
           bootstrap_lease_ttl: 300,
           dynamic_rmq_creds:   false,

data/lib/legion/crypt/vault.rb

@@ -19,8 +19,9 @@ module Legion
         @sessions = []
         vault_settings = Legion::Settings[:crypt][:vault]
         ::Vault.address = resolve_vault_address(vault_settings)
+        ::Vault.ssl_verify = resolve_ssl_verify(vault_settings[:tls])
         namespace = vault_settings[:vault_namespace]
-        log.info "Vault connection requested address=#{::Vault.address} namespace=#{namespace || 'none'}"
+        log.info "Vault connection requested address=#{::Vault.address} namespace=#{namespace || 'none'} ssl_verify=#{::Vault.ssl_verify}"
 
         Legion::Settings[:crypt][:vault][:token] = ENV['VAULT_DEV_ROOT_TOKEN_ID'] if ENV.key? 'VAULT_DEV_ROOT_TOKEN_ID'
         return nil if Legion::Settings[:crypt][:vault][:token].nil?
@@ -209,6 +210,13 @@ module Legion
         data[:data]
       end
 
+      def resolve_ssl_verify(tls_config)
+        return true if tls_config.nil?
+
+        verify = tls_config[:verify]&.to_s
+        verify != 'none'
+      end
+
       def resolve_vault_address(vault_settings)
         protocol = vault_settings[:protocol] || 'http'
         address  = vault_settings[:address] || 'localhost'

data/lib/legion/crypt/vault_cluster.rb

@@ -118,11 +118,13 @@ module Legion
         return nil unless config.is_a?(Hash)
 
         addr = "#{config[:protocol]}://#{config[:address]}:#{config[:port]}"
-        log.info "Building Vault client address=#{addr} namespace=#{config[:namespace].inspect}"
+        ssl_verify = resolve_cluster_ssl_verify(config[:tls])
+        log.info "Building Vault client address=#{addr} namespace=#{config[:namespace].inspect} ssl_verify=#{ssl_verify}"
         log_vault_debug("build_vault_client: address=#{addr}")
         client = ::Vault::Client.new(
-          address: addr,
-          token:   config[:token]
+          address:    addr,
+          token:      config[:token],
+          ssl_verify: ssl_verify
         )
         namespace =
           if config.key?(:namespace)
@@ -136,6 +138,13 @@ module Legion
         client
       end
 
+      def resolve_cluster_ssl_verify(tls_config)
+        return true if tls_config.nil?
+
+        verify = tls_config[:verify]&.to_s
+        verify != 'none'
+      end
+
       def log_vault_error(name, error, operation: 'crypt.vault_cluster.error')
         handle_exception(error, level: :error, operation: operation, cluster_name: name)
       end

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.5.7'
+    VERSION = '1.5.8'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.5.7
+  version: 1.5.8
 platform: ruby
 authors:
 - Esity