lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

save wolf state and document

Browse source
This commit is contained in:
Rongsong Shen 2026-07-23 09:20:59 +00:00
parent c921e59bac
commit cae4ef0cc7
5 changed files with 2155 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

22
.wolf/buglog.json
View file

@ -13753,5 +13753,27 @@
],
"occurrences": 1,
"last_seen": "2026-07-23T03:29:19.000Z"
},
{
"id": "bug-1463",
"timestamp": "2026-07-23T06:37:00.000Z",
"error_message": "xcecli build fails: ../common/request/request.go:143:32: undefined: tls / :144:13: undefined: loadRootCAs -- FAILED: [code=1] frontend/xcecli/xcecli",
"file": "src/frontend/xcecli/common/request/request.go, src/frontend/xcecli/cmd/jobs/peek.go",
"root_cause": "Commit 94f50ce6 (bug-1453, CA-cert-plumbing removal) deleted the crypto/tls import, loadRootCAs, and SetRootCAs from request.go and stripped certPath from GetRequestFromAPIServer/PostRequestToAPIServer/DeleteRequestFromAPIServer plus their ~18 call sites, but missed GetJobOutput() (still referenced tls.Config{RootCAs: loadRootCAs(certPath)} with no import) and its sole caller cmd/jobs/peek.go, which still called apiClient.SetRootCAs(serverInfo.CACert) (SetRootCAs no longer exists anywhere) and passed serverInfo.CACert (the CACert field was already removed from APIServerInfo in config/config.go). Go compiles per-package, so once common/request failed to compile, the compiler never got far enough to surface peek.go's own two dangling references in the same build run -- they were latent until request.go compiled again.",
"fix": "FIXED 2026-07-23. request.go: removed GetJobOutput's dead TLS block, dropped certPath from its signature (token, jobID, params). peek.go: removed the SetRootCAs call, updated the GetJobOutput call site to the new 3-arg signature. Also enabled NewAPIClient's previously-commented-out `c.Client.SetTLSClientConfig(&tls.Config{InsecureSkipVerify: true})` -- per user request (xcecli needs to actually connect to an https API server) and per bug-1453's own documented design intent (\"server-side TLS only, encryption without peer certificate verification\"), since prior to this no xcecli method set any TLS config at all, meaning ANY https:// apiserver URL (self-signed/auto-generated cert, the common case) would have failed Go's default cert verification -- this was broader than just GetJobOutput. Added crypto/tls import accordingly. Documented both the api-server (http+https) and controller (server-side-cert-only, no client certs) TLS postures as a durable rule in .kiro/steering/security.md's Transport section, replacing a now-stale line claiming TLS is handled at the network layer. Verified: full `all debug` rebuild green (355/355 ninja targets), frontend/xcecli/xcecli binary produced with fresh mtime, no new warnings, no test fallout (grep for GetJobOutput/SetRootCAs/loadRootCAs across *_test.go in xcecli returns nothing).",
"tags": [
"xcecli",
"tls",
"https",
"dead-code",
"build-break",
"ca-cert-removal",
"auto-detected"
],
"related_bugs": [
"bug-1453"
],
"occurrences": 1,
"last_seen": "2026-07-23T06:58:42.000Z"
}
]