Merge pull request #2805 from ferd/otp-hostname-check

Defer hostname check to OTP when supported
erlang · Jul 6, 2023 · c46bec6 · c46bec6
2 parents 64842a2 + e408994
commit c46bec6
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 10 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -43,6 +43,10 @@ jobs:
     - uses: actions/checkout@v2
     - name: Brew Version Check
       run: brew --version
+    - name: Brew Cleanup
+      run: brew cleanup
+    - name: Debug Brew
+      run: brew doctor
     - name: Keep Brew Fresh
       run: brew update
     - name: Install Erlang

diff --git a/apps/rebar/src/rebar_utils.erl b/apps/rebar/src/rebar_utils.erl
@@ -1073,26 +1073,26 @@ get_cacerts() ->
 ssl_opts(ssl_verify_enabled, Url) ->
     case check_ssl_version() of
         true ->
-            #{host := Hostname} = rebar_uri:parse(rebar_utils:to_list(Url)),
-            VerifyFun = {fun ssl_verify_hostname:verify_fun/3,
-                         [{check_hostname, Hostname}]},
             CACerts = get_cacerts(),
             SslOpts = [{verify, verify_peer}, {depth, 10}, {cacerts, CACerts},
-                       {partial_chain, fun partial_chain/1}, {verify_fun, VerifyFun}],
-            check_hostname_opt(SslOpts);
+                       {partial_chain, fun partial_chain/1}],
+            check_hostname_opt(Url, SslOpts);
         false ->
             ?WARN("Insecure HTTPS request (peer verification disabled), "
                   "please update to OTP 17.4 or later", []),
             [{verify, verify_none}]
     end.
 
 -ifdef(no_customize_hostname_check).
-check_hostname_opt(Opts) ->
-  Opts.
+check_hostname_opt(Url, Opts) ->
+    #{host := Hostname} = rebar_uri:parse(rebar_utils:to_list(Url)),
+    VerifyFun = {fun ssl_verify_hostname:verify_fun/3,
+                 [{check_hostname, Hostname}]},
+    [{verify_fun, VerifyFun} | Opts].
 -else.
-check_hostname_opt(Opts) ->
-  MatchFun = public_key:pkix_verify_hostname_match_fun(https),
-  [{customize_hostname_check, [{match_fun, MatchFun}]} | Opts].
+check_hostname_opt(_, Opts) ->
+    MatchFun = public_key:pkix_verify_hostname_match_fun(https),
+    [{customize_hostname_check, [{match_fun, MatchFun}]} | Opts].
 -endif.
 
 -spec partial_chain(Certs) -> Res when