systemlink-cli 1.13.10__tar.gz → 1.13.12__tar.gz

{systemlink_cli-1.13.10 → systemlink_cli-1.13.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: systemlink-cli
-Version: 1.13.10
+Version: 1.13.12
 Summary: SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates.
 License-File: LICENSE
 Author: Fred Visser
@@ -18,7 +18,7 @@ Requires-Dist: pygments (>=2.20.0)
 Requires-Dist: pyyaml (>=6.0.3,<7.0.0)
 Requires-Dist: questionary (>=2.1.1,<3.0.0)
 Requires-Dist: requests (>=2.32.4,<3.0.0)
-Requires-Dist: rich (>=13.7,<15)
+Requires-Dist: rich (>=15,<16)
 Requires-Dist: rich-click (>=1.8,<2)
 Requires-Dist: tabulate (>=0.10.0,<0.11.0)
 Requires-Dist: truststore (>=0.9,<0.11)

{systemlink_cli-1.13.10 → systemlink_cli-1.13.12}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "systemlink-cli"
-version = "1.13.10"
+version = "1.13.12"
 description = "SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates."
 authors = ["Fred Visser <fred.visser@emerson.com>"]
 packages = [{ include = "slcli" }]
@@ -38,7 +38,7 @@ watchdog = "^6.0.0"
 pyyaml = "^6.0.3"
 questionary = "^2.1.1"
 packaging = ">=21.0"
-rich = ">=13.7,<15"
+rich = ">=15,<16"
 rich-click = ">=1.8,<2"
 cryptography = ">=46.0.7"
 pygments = ">=2.20.0"

{systemlink_cli-1.13.10 → systemlink_cli-1.13.12}/slcli/_version.py

@@ -1,4 +1,4 @@
 """Version information for slcli."""
 
 # This file is auto-generated. Do not edit manually.
-__version__ = "1.13.10"
+__version__ = "1.13.12"

{systemlink_cli-1.13.10 → systemlink_cli-1.13.12}/slcli/main.py

@@ -1,10 +1,15 @@
 """slcli entry points."""
 
+import hashlib
 import json
+import os
+import socket
+import ssl
 import tomllib
 from pathlib import Path
 from types import ModuleType
-from typing import Optional
+from typing import List, Optional, Tuple
+from urllib.parse import urlparse
 
 import click as base_click
 import keyring
@@ -95,6 +100,191 @@ def _configure_rich_click_command_groups() -> None:
     }
 
 
+def _get_ca_source_display() -> str:
+    """Describe the CA source used for HTTPS verification."""
+    if OS_TRUST_INJECTED:
+        return f"system (reason={OS_TRUST_REASON})"
+
+    verify_env = os.environ.get("REQUESTS_CA_BUNDLE") or os.environ.get("SSL_CERT_FILE")
+    if verify_env:
+        return f"custom-pem ({verify_env})"
+
+    return f"certifi (reason={OS_TRUST_REASON})"
+
+
+def _build_tls_debug_context(ssl_verify: bool) -> ssl.SSLContext:
+    """Build an SSL context aligned with the current CLI trust configuration."""
+    if not ssl_verify:
+        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        return ctx
+
+    verify_env = os.environ.get("REQUESTS_CA_BUNDLE") or os.environ.get("SSL_CERT_FILE")
+    if verify_env:
+        return ssl.create_default_context(cafile=verify_env)
+
+    if OS_TRUST_INJECTED:
+        try:
+            import truststore  # type: ignore[import-not-found]
+
+            return truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        except (AttributeError, ImportError, RuntimeError, OSError, ssl.SSLError, ValueError):
+            pass
+
+    return ssl.create_default_context()
+
+
+def _format_cert_name(name: object) -> str:
+    """Flatten SSL certificate subject or issuer names for display."""
+    if not isinstance(name, tuple):
+        return "Unavailable"
+
+    parts: List[str] = []
+    for relative_name in name:
+        if not isinstance(relative_name, tuple):
+            continue
+        try:
+            for key, value in relative_name:
+                if not isinstance(key, str) or not isinstance(value, str):
+                    continue
+                parts.append(f"{key}={value}")
+        except (TypeError, ValueError):
+            continue
+    return ", ".join(parts) if parts else "Unavailable"
+
+
+def _format_subject_alt_names(subject_alt_names: object) -> str:
+    """Format certificate SANs for compact debug output."""
+    if not isinstance(subject_alt_names, tuple) or not subject_alt_names:
+        return "Unavailable"
+
+    entries: List[str] = []
+    extra_count = 0
+    for subject_alt_name in subject_alt_names:
+        if (
+            not isinstance(subject_alt_name, tuple)
+            or len(subject_alt_name) != 2
+            or not isinstance(subject_alt_name[0], str)
+            or not isinstance(subject_alt_name[1], str)
+        ):
+            continue
+
+        if len(entries) < 5:
+            entries.append(f"{subject_alt_name[0]}={subject_alt_name[1]}")
+        else:
+            extra_count += 1
+
+    if extra_count:
+        entries.append(f"... (+{extra_count} more)")
+
+    return ", ".join(entries)
+
+
+def _get_proxy_debug_rows(api_url: str) -> List[Tuple[str, str]]:
+    """Return a compact view of proxy environment state for the target URL."""
+    import requests
+
+    effective_proxies = requests.utils.get_environ_proxies(api_url)
+    return [
+        (
+            "Proxy HTTPS",
+            "set" if os.environ.get("HTTPS_PROXY") or os.environ.get("https_proxy") else "unset",
+        ),
+        (
+            "Proxy HTTP",
+            "set" if os.environ.get("HTTP_PROXY") or os.environ.get("http_proxy") else "unset",
+        ),
+        (
+            "Proxy NO_PROXY",
+            "set" if os.environ.get("NO_PROXY") or os.environ.get("no_proxy") else "unset",
+        ),
+        ("Proxy Active", "yes" if effective_proxies else "no"),
+    ]
+
+
+def _probe_tls_connection(api_url: str, ssl_verify: bool) -> List[Tuple[str, str]]:
+    """Collect TLS handshake and leaf certificate details for the API host."""
+    import requests
+
+    if not api_url or api_url == "Not configured":
+        return [("TLS Probe", "Skipped (API URL not configured)")]
+
+    parsed = urlparse(api_url)
+    if parsed.scheme.lower() != "https":
+        return [("TLS Probe", "Skipped (non-HTTPS API URL)")]
+
+    hostname = parsed.hostname
+    if not hostname:
+        return [("TLS Probe", "Skipped (unable to parse host)")]
+
+    if requests.utils.get_environ_proxies(api_url):
+        return [("TLS Probe", "Skipped (proxy-configured environment)")]
+
+    port = parsed.port or 443
+    target = f"{hostname}:{port}"
+
+    try:
+        context = _build_tls_debug_context(ssl_verify)
+        with socket.create_connection((hostname, port), timeout=5) as tcp_socket:
+            with context.wrap_socket(tcp_socket, server_hostname=hostname) as tls_socket:
+                cert = tls_socket.getpeercert()
+                cert_bytes = tls_socket.getpeercert(binary_form=True)
+                cipher = tls_socket.cipher()
+
+                rows: List[Tuple[str, str]] = [
+                    ("TLS Target", target),
+                    ("TLS Version", tls_socket.version() or "Unavailable"),
+                    ("TLS Cipher", cipher[0] if cipher else "Unavailable"),
+                ]
+
+                if isinstance(cert, dict):
+                    rows.extend(
+                        [
+                            ("Leaf Cert Subject", _format_cert_name(cert.get("subject", ()))),
+                            ("Leaf Cert Issuer", _format_cert_name(cert.get("issuer", ()))),
+                            (
+                                "Leaf Cert SANs",
+                                _format_subject_alt_names(cert.get("subjectAltName", ())),
+                            ),
+                            ("Leaf Cert Valid From", str(cert.get("notBefore", "Unavailable"))),
+                            ("Leaf Cert Valid To", str(cert.get("notAfter", "Unavailable"))),
+                        ]
+                    )
+
+                if cert_bytes:
+                    rows.append(("Leaf Cert SHA256", hashlib.sha256(cert_bytes).hexdigest()))
+
+                return rows
+    except Exception as exc:
+        return [
+            ("TLS Target", target),
+            ("TLS Probe Error", f"{exc.__class__.__name__}: {exc}"),
+        ]
+
+
+def _collect_info_debug_rows(api_url: str) -> List[Tuple[str, str]]:
+    """Return structured connection diagnostics for info --debug."""
+    from .utils import get_ssl_verify
+
+    ssl_verify = get_ssl_verify()
+    rows = [
+        ("SSL Verify", "enabled" if ssl_verify else "disabled"),
+        ("CA Source", _get_ca_source_display()),
+    ]
+    rows.extend(_get_proxy_debug_rows(api_url))
+    rows.extend(_probe_tls_connection(api_url, ssl_verify))
+    return rows
+
+
+def _emit_info_debug_diagnostics(api_url: str) -> None:
+    """Write structured connection diagnostics to stderr."""
+    click.echo("Debug Connection Diagnostics:", err=True)
+    for label, value in _collect_info_debug_rows(api_url):
+        click.echo(f"  {label}: {value}", err=True)
+    click.echo(err=True)
+
+
 _configure_rich_click_command_groups()
 
 
@@ -201,17 +391,7 @@ def cli(ctx: base_click.Context, version: bool, profile: Optional[str]) -> None:
 @cli.command(hidden=True, name="_ca-info")
 def ca_info() -> None:
     """Show TLS CA trust source (hidden diagnostic)."""
-    if OS_TRUST_INJECTED:
-        click.echo(f"CA Source: system (reason={OS_TRUST_REASON})")
-    else:
-        # Determine if custom verify path set via env
-        import os
-
-        verify_env = os.environ.get("REQUESTS_CA_BUNDLE") or os.environ.get("SSL_CERT_FILE")
-        if verify_env:
-            click.echo(f"CA Source: custom-pem ({verify_env})")
-        else:
-            click.echo(f"CA Source: certifi (reason={OS_TRUST_REASON})")
+    click.echo(f"CA Source: {_get_ca_source_display()}")
 
 
 @cli.command()
@@ -375,6 +555,9 @@ def info(format: str, skip_health: bool, debug: bool) -> None:
 
     platform_info = get_platform_info(skip_health=skip_health)
 
+    if debug:
+        _emit_info_debug_diagnostics(platform_info.get("api_url") or "Not configured")
+
     # Add profile information
     cfg = ProfileConfig.load()
     active_profile = get_active_profile()