mlsmaycon 8a716f1294 [management] Check a record when TLS verification is switched back on ...

The skip-TLS exemption added a hole of its own. Such a record is stored without
being checked at all, and the re-check on update watched only the upstream, the
key and the catalog entry — so turning verification back on left a provider
that had never been checked now running as if it had. That transition is the
first moment the record can be checked, and it now is.

An update that preserves the stored key trims it on the way through, so a
record saved before keys were normalised is repaired by the next edit rather
than carrying whitespace the proxy still sends. That makes the comparison see a
change, which is right: the key has never been tested in the form it is about
to be sent in.

The create description also claimed more of the upstream than the check reads.
Only the host is used — the listing goes to the catalog's own path over HTTPS —
so a configured scheme or path is neither used nor validated there.

2026-08-27 08:33:57 +00:00

..

api

[management] Check a record when TLS verification is switched back on

2026-08-27 08:33:57 +00:00

util

[management] add pat rate limiting (#4741)

2025-11-07 15:50:18 +01:00