systemlink-cli 2.2.2__tar.gz → 2.3.1__tar.gz

{systemlink_cli-2.2.2 → systemlink_cli-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: systemlink-cli
-Version: 2.2.2
+Version: 2.3.1
 Summary: SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates.
 License-File: LICENSE
 Author: Fred Visser
@@ -18,6 +18,7 @@ Requires-Dist: cryptography (>=49.0.0)
 Requires-Dist: filelock (>=3.20,<4)
 Requires-Dist: httpcore2 (>=2.10.0,<3) ; extra == "mcp"
 Requires-Dist: httpx2 (>=2.12.0,<3) ; extra == "mcp"
+Requires-Dist: idna (>=3.10,<4)
 Requires-Dist: keyring (>=25.6.0,<26.0.0)
 Requires-Dist: mcp (>=2,<3) ; extra == "mcp"
 Requires-Dist: msgpack (>=1.1,<2) ; extra == "managed-client"

{systemlink_cli-2.2.2 → systemlink_cli-2.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "systemlink-cli"
-version = "2.2.2"
+version = "2.3.1"
 description = "SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates."
 authors = ["Fred Visser <fred.visser@emerson.com>"]
 packages = [{ include = "slcli" }]
@@ -29,6 +29,7 @@ click = ">=7.1.2"
 filelock = ">=3.20,<4"
 keyring = "^25.6.0"
 requests = "^2.32.4"
+idna = ">=3.10,<4"
 tabulate = "^0.10.0"
 truststore = ">=0.9,<0.11"
 watchdog = "^6.0.0"

{systemlink_cli-2.2.2 → systemlink_cli-2.3.1}/slcli/_version.py

@@ -1,4 +1,4 @@
 """Version information for slcli."""
 
 # This file is auto-generated. Do not edit manually.
-__version__ = "2.2.2"
+__version__ = "2.3.1"

{systemlink_cli-2.2.2 → systemlink_cli-2.3.1}/slcli/config_click.py

@@ -6,6 +6,7 @@ import os
 import re
 import ssl
 import sys
+from pathlib import Path
 from typing import Any, NoReturn, Optional
 from urllib.parse import urlparse
 
@@ -26,14 +27,16 @@ from .platform import (
 from .profiles import Profile, ProfileConfig, check_config_file_permissions
 from .rich_output import render_table
 from .ssl_trust import (
+    get_managed_trust_path,
     get_managed_trust_records,
     get_ssl_server_origin,
     inspect_server_certificate,
+    load_ca_certificate,
     remove_managed_trust,
     save_managed_certificate,
 )
 from .table_utils import output_formatted_list
-from .utils import ExitCodes, get_base_url, get_base_url_resolution
+from .utils import ExitCodes, get_base_url_resolution
 
 API_KEY_LENGTH = 42
 API_KEY_PATTERN = re.compile(rf"^[A-Za-z0-9_-]{{{API_KEY_LENGTH}}}$")
@@ -765,12 +768,31 @@ def register_config_commands(cli: Any) -> None:
             )
 
         certificate_details = certificate.to_dict()
+        trusted_certificate = None
+        try:
+            trusted_path = get_managed_trust_path(certificate.origin)
+            if trusted_path is not None:
+                trusted_certificate = json.loads(
+                    trusted_path.with_suffix(".json").read_text(encoding="utf-8")
+                )
+                trusted_certificate["origin"] = certificate.origin
+                trusted_certificate.setdefault("trust-type", "leaf")
+        except (OSError, ValueError) as exc:
+            click.echo(f"Could not read managed certificate metadata: {exc}.", err=True)
+            trusted_certificate = None
         if output_format == "json":
+            certificate_details["trusted-certificate"] = trusted_certificate
             click.echo(json.dumps(certificate_details, indent=2))
             return
 
         click.echo(f"Server certificate for {certificate_details.get('origin', 'unknown')}")
         _show_certificate_details(certificate_details)
+        if trusted_certificate:
+            kind = "CA" if trusted_certificate.get("trust-type") == "ca" else "leaf"
+            click.echo(f"\nTrusted {kind} certificate for this origin")
+            _show_certificate_details(trusted_certificate)
+        else:
+            click.echo("\nNo managed trust certificate for this origin.")
 
     @trust.command(name="list")
     @click.option(
@@ -794,13 +816,14 @@ def register_config_commands(cli: Any) -> None:
             [
                 str(record.get("origin", "")),
                 str(record.get("fingerprint", "")),
+                "CA" if record.get("trust-type") == "ca" else "leaf",
                 "yes" if record.get("self-signed") else "no",
             ]
             for record in records
         ]
         render_table(
-            headers=["SERVER", "SHA-256", "SELF-SIGNED"],
-            column_widths=[40, 64, 12],
+            headers=["SERVER", "SHA-256", "TRUST TYPE", "SELF-SIGNED"],
+            column_widths=[40, 64, 10, 12],
             rows=rows,
             show_total=True,
             total_label="certificate(s)",
@@ -808,30 +831,47 @@ def register_config_commands(cli: Any) -> None:
 
     @trust.command(name="add")
     @click.option("--url", help="HTTPS server URL (defaults to the active API URL)")
+    @click.option(
+        "--certificate",
+        type=click.Path(exists=True, dir_okay=False, path_type=Path),
+        help="Import one public CA certificate (PEM or DER), scoped to this server origin",
+    )
     @click.option(
         "--fingerprint",
         required=True,
         help="Expected SHA-256 fingerprint of the certificate to trust",
     )
-    def add_trusted_certificate(url: Optional[str], fingerprint: str) -> None:
-        """Trust a server certificate after verifying its fingerprint."""
-        server_url = url or get_base_url()
+    def add_trusted_certificate(
+        url: Optional[str], certificate: Optional[Path], fingerprint: str
+    ) -> None:
+        """Trust a live server certificate or imported CA after fingerprint verification."""
+        server_url = url or get_base_url_resolution().value
         try:
             expected_fingerprint = _normalize_fingerprint(fingerprint)
-            certificate = inspect_server_certificate(server_url)
+            trusted_certificate = (
+                load_ca_certificate(server_url, certificate)
+                if certificate is not None
+                else inspect_server_certificate(server_url)
+            )
         except (OSError, ValueError, ssl.SSLError) as exc:
-            _exit_with_validation_error(f"Could not inspect the server certificate: {exc}.")
+            _exit_with_validation_error(f"Could not load the certificate: {exc}.")
 
-        _show_certificate_warning(certificate.to_dict())
-        if certificate.fingerprint != expected_fingerprint:
+        _show_certificate_details(trusted_certificate.to_dict(), err=True)
+        if trusted_certificate.fingerprint != expected_fingerprint:
             _exit_with_validation_error(
-                "The server certificate fingerprint does not match the supplied fingerprint."
+                "The certificate fingerprint does not match the supplied fingerprint."
+            )
+        if trusted_certificate.trust_type == "ca":
+            click.echo(
+                "Trusting certificates issued by this CA for this origin only; "
+                "hostname and validity verification remain enabled.",
+                err=True,
             )
         try:
-            path = save_managed_certificate(certificate)
+            path = save_managed_certificate(trusted_certificate)
         except OSError as exc:
             _exit_with_validation_error(f"Could not save the trusted certificate: {exc}.")
-        click.echo(f"✓ Trusted certificate for {certificate.origin}")
+        click.echo(f"✓ Trusted certificate for {trusted_certificate.origin}")
         click.echo(f"  Certificate file: {path}")
 
     @trust.command(name="remove")
@@ -839,7 +879,7 @@ def register_config_commands(cli: Any) -> None:
     @click.option("--force", is_flag=True, help="Skip confirmation prompt")
     def remove_trusted_certificate(url: Optional[str], force: bool) -> None:
         """Remove a server certificate from the managed trust store."""
-        server_url = url or get_base_url()
+        server_url = url or get_base_url_resolution().value
         try:
             origin = get_ssl_server_origin(server_url)
         except ValueError as exc:

{systemlink_cli-2.2.2 → systemlink_cli-2.3.1}/slcli/main.py

@@ -35,7 +35,7 @@ from .rich_output import install_rich_output, render_table
 from .routine_click import register_routine_commands
 from .skill_click import register_skill_commands
 from .spec_click import register_spec_commands
-from .ssl_trust import OS_TRUST_INJECTED, OS_TRUST_REASON
+from .ssl_trust import OS_TRUST_INJECTED, OS_TRUST_REASON, create_explicit_tls_context
 from .state_click import register_state_commands
 from .system_click import register_system_commands
 from .tag_click import register_tag_commands
@@ -143,11 +143,11 @@ def _build_tls_debug_context(ssl_verify: Union[bool, str]) -> ssl.SSLContext:
         return ctx
 
     if isinstance(ssl_verify, str):
-        return ssl.create_default_context(cafile=ssl_verify)
+        return create_explicit_tls_context(ssl_verify)
 
     verify_env = os.environ.get("REQUESTS_CA_BUNDLE") or os.environ.get("SSL_CERT_FILE")
     if verify_env:
-        return ssl.create_default_context(cafile=verify_env)
+        return create_explicit_tls_context(verify_env)
 
     if OS_TRUST_INJECTED:
         try: