OpenCHAMI / ochami / 39491255821

93%

push

github

fix(cmd)!: reject --cacert combined with --insecure (#204)

--insecure skips TLS certificate verification entirely, but every
service client constructor builds its transport with
WithInsecure(rt.Insecure) and then unconditionally calls
rt.UseCACert(...). UseCACert (pkg/client/client.go) always sets
InsecureSkipVerify = false once a CA is loaded, so passing both flags
together silently discarded --insecure the moment --cacert was also
set, with no warning to the user.

Since the two flags express contradictory intent (skip all
verification vs. verify against a specific CA), reject the combination
outright rather than letting one silently win, matching the existing
precedent for --cluster/--cluster-uri and --token/--no-token (both
already MarkFlagsMutuallyExclusive on rootCmd). This resolves to
CodeUsage automatically via the tree-wide WrapUsageErrors wiring, so
no additional error-handling code is needed.

TestRootCommand_RejectsCACertWithInsecure (cmd/root_errors_test.go)
covers the new rejection end to end, and ochami(1) notes that the two
flags can't be combined.

BREAKING CHANGE: Passing --cacert and --insecure together is a usage
error (exit code 2) instead of verifying against the CA and ignoring
--insecure.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>

2 of 2 new or added lines in 1 file covered. (100.0%)

12937 of 13976 relevant lines covered (92.57%)

541.13 hits per line