package https-eio

  1. Overview
  2. Docs
Authenticated HTTPS client wrapper for Eio (cohttp-eio's ~https hook)

Install 

dune-project
 Dependency

github.com Readme Changelog Edit opam file Versions (1)

Authors

  1. L
    lbendtly

Maintainers

  1. L
    lbendtlynielsen@gmail.com

Sources

v0.1.0.tar.gz
md5=c009f83b36950ea806c3f7cb0d02643d
sha512=92b1fab83b510953b6e19f5ef1eda376e6762ae31b5f2b23ae0eb4a62f95cb3e2df74eff828cc773e1dd3a6bb8be6d611cd679c8fdc70b3f9750c8aff72a9aaf

Description

Builds the Uri.t -> flow -> Tls_eio.t wrapper that cohttp-eio's client expects for its ~https hook: system CA bundle detection (via ca-certs), a Tls.Config.client, and the one-time Mirage_crypto_rng seed that TLS handshake needs before it can generate any key/nonce material. Extracted from four independent, byte-identical copies of this code (aws-eio's Aws_tls, obs-loki-eio's Obs_loki_tls, obs-prometheus-eio's Obs_prometheus_tls, and Sun's in-tree Kafka_service_tls) after an unseeded-RNG bug had to be hand-ported across all four. Not a general-purpose TLS or HTTP library — only the narrow wrapper cohttp-eio's ~https parameter needs.

Added to opam-repository:

README

https-eio

Authenticated HTTPS client wrapper for Eio — the Uri.t -> flow -> Tls_eio.t function cohttp-eio's client expects for its ~https hook.

Not a general-purpose TLS or HTTP library. It does exactly three things:

  • Detects the system CA trust store via ca-certs (no hand-rolled, platform-specific path list).
  • Builds a Tls.Config.client from that trust store.
  • Seeds Mirage_crypto_rng before the first real handshake and caches the built wrapper, domain-safely (double-checked locking over an Atomic.t, not a bare Stdlib.Lazy.t — see lib/https_eio.ml for why).

Extracted after the same ~90 lines were found duplicated, byte-for-byte, across four packages (aws-eio, obs-loki-eio, obs-prometheus-eio, and Sun's in-tree kafka-eio-service) — see CHANGES.md. There's no separate published opam library for this; cohttp-eio's own repo ships the same pattern as example code (cohttp-eio/examples/client_tls.ml) rather than a reusable package.

Usage

Eio_main.run @@ fun env ->
match Https_eio.https_for_uri (Uri.of_string "https://example.com") with
| Error e -> failwith (Https_eio.error_to_string e)
| Ok https ->
  let client = Cohttp_eio.Client.make ~https env#net in
  ...

Build

eval $(opam env)
dune build

Test

dune runtest

No external infrastructure required — the handshake test spins up a local self-signed TLS server (fixtures in test/tls_fixtures/, not trusted by the system CA bundle) and asserts the handshake fails on certificate trust, not on an unseeded RNG.

Dependencies (9)

  1. domain-name >= "0.5.0"
  2. ca-certs >= "1.0.1"
  3. x509 >= "1.0.0"
  4. mirage-crypto-rng >= "2.1.0"
  5. tls-eio >= "2.1.0"
  6. uri >= "4.4.0"
  7. eio >= "1.3"
  8. ocaml >= "5.4.0"
  9. dune >= "3.0"

Dev Dependencies (3)

  1. odoc with-doc
  2. alcotest with-test
  3. eio_main >= "1.3" & with-test

Used by

None

Conflicts

None