package https-eio

https-eio

Authenticated HTTPS client wrapper for Eio — the Uri.t -> flow -> Tls_eio.t function cohttp-eio's client expects for its ~https hook.

Not a general-purpose TLS or HTTP library. It does exactly three things:

• Detects the system CA trust store via ca-certs (no hand-rolled, platform-specific path list).
• Builds a Tls.Config.client from that trust store.
• Seeds Mirage_crypto_rng before the first real handshake and caches the built wrapper, domain-safely (double-checked locking over an Atomic.t, not a bare Stdlib.Lazy.t — see lib/https_eio.ml for why).

Extracted after the same ~90 lines were found duplicated, byte-for-byte, across four packages (aws-eio, obs-loki-eio, obs-prometheus-eio, and Sun's in-tree kafka-eio-service) — see CHANGES.md. There's no separate published opam library for this; cohttp-eio's own repo ships the same pattern as example code (cohttp-eio/examples/client_tls.ml) rather than a reusable package.

Usage

Eio_main.run @@ fun env ->
match Https_eio.https_for_uri (Uri.of_string "https://example.com") with
| Error e -> failwith (Https_eio.error_to_string e)
| Ok https ->
  let client = Cohttp_eio.Client.make ~https env#net in
  ...

Build

eval $(opam env)
dune build

Test

dune runtest

No external infrastructure required — the handshake test spins up a local self-signed TLS server (fixtures in test/tls_fixtures/, not trusted by the system CA bundle) and asserts the handshake fails on certificate trust, not on an unseeded RNG.