Use os trust store for https kb

[soimkim]

Python urllib failed on Windows with CERTIFICATE_VERIFY_FAILED while the browser succeeded. Verify KB HTTPS against the OS certificate store and allow KB_SSL_VERIFY=false as an escape hatch.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c244b73-b833-4609-862f-3f8f88442d52

📥 Commits

Reviewing files that changed from the base of the PR and between 33da004 and 721aa4b.

📒 Files selected for processing (5)

• pyproject.toml
• src/fosslight_source/_help.py
• src/fosslight_source/_kb_client.py
• src/fosslight_source/cli.py
• tests/test_kb_ssl.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds truststore support and configurable KB TLS certificate verification. KB requests and health checks now use the generated SSL context. Help text and tests document and validate the behavior.

Changes

KB TLS configuration and request flow

Layer / File(s)	Summary
TLS context configuration pyproject.toml, src/fosslight_source/_kb_client.py, src/fosslight_source/_help.py, tests/test_kb_ssl.py	The project adds truststore. KB_SSL_VERIFY controls certificate verification. SSL context creation supports OS certificates, default certificates, and explicitly disabled verification. Help text and tests cover the configuration.
KB request integration src/fosslight_source/_kb_client.py, src/fosslight_source/cli.py, tests/test_kb_ssl.py	KB requests and reachability checks pass the generated SSL context to urllib.request.urlopen. Tests validate context propagation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 721aa

This localized change updates HTTPS certificate verification behavior for knowledge-base access and adds an explicit escape hatch; no actionable merge-blocking risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant create_kb_ssl_context
  participant urllib.request.urlopen
  participant KB Server
  CLI->>create_kb_ssl_context: Create SSLContext
  create_kb_ssl_context-->>CLI: Return SSLContext
  CLI->>urllib.request.urlopen: Request with context
  urllib.request.urlopen->>KB Server: HTTPS request

Loading

Suggested reviewers: justinwonjaepark

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 8.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 4 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: using the OS trust store for HTTPS Knowledge Base connections.

Full details: Docstring Coverage

Explanation

Docstring coverage is 8.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 4 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch certi

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}