* fix: ensure HTTP requests use proxy env vars
Updated all instances of `http.Transport` to include the `Proxy` field set to `http.ProxyFromEnvironment`. This ensures that the application respects proxy configuration defined by the `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables.
### Changes:
- Modified `http.Transport` initialization across the codebase to use:
```go
Proxy: http.ProxyFromEnvironment
```
- Ensured TLS configurations remain intact by preserving `TLSClientConfig`.
### Why:
- Previously, HTTP requests bypassed proxy settings due to missing configuration in the transport layer.
- This fix enables compatibility with proxied environments, aligning with standard Go behavior.
### Impact:
- All HTTP and HTTPS traffic now adheres to proxy settings.
- Domains listed in `NO_PROXY` bypass the proxy as expected.
### Verification:
- Tested with proxy environment variables set (`HTTP_PROXY`, `HTTPS_PROXY`).
- Verified requests route through the proxy and `NO_PROXY` works as intended.
* reformat with fmt
---------
Co-authored-by: Cormac Doherty <cormac.doherty@ncsc.gov.ie>
* Change the go module path
from github.com/csaf-poc/csaf_distribution to github.com/gocsaf/csaf.
* Rename archive for release tarballs.
* Adjust testing scripts and documentation.
* Convert a lot of variables to snake case
* Add snakecase for variables made out of two words that had it in no version yet (for consistency)
* Adjust example files too
---------
Co-authored-by: JanHoefelmeyer <hoefelmeyer.jan@gmail.com>
* started with forwarding support in downloader
* Add missing files.
* Add missing files.
* Raise needed Go version
* More Go version bumping.
* Fix forwarding
* Go 1.21+ needed
* Make terminating forwarder more robust.
* Better var naming
* Remove dead code. Improve commentary.
* Prepare validation status adjustment.
* Move validations to functions to make them executable in a loop.
* Introduce validation mode flag (strict, unsafe)
* Make uploader use the TOML config file intrastructure, too.
* Improve method naming a bit.
* Improve method naming a bit.
* Add forgotten struct tags for TOML
* Add version to command line only parameters in uploader documentation
* Be explicit about supported options in config file.
* allow interactive flags in config file.
---------
Co-authored-by: JanHoefelmeyer <Jan Höfelmeyer jhoefelmeyer@intevation.de>
* Label the option experimental and limited at all places.
* Point to the downloader documentation as single point to write more.
* Add more hints on how the old PEM block encryption is experimental
and why it often shall not be used.
---------
Co-authored-by: JanHoefelmeyer <hoefelmeyer.jan@gmail.com>
Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
* Change options when creating the armored version of the signature
to leave out the optional headers, which would be `Version:`
and `Comment:`, as it is considered uncommon for a while now to
set these.
* Add util function to check a filename for confirming to csaf-v2.0-csd02.
* Add code to reject bad filenames in provider, checker, aggregator and uploader.
* Add flag to display the version for each binary. It is based on `git describe` but adds
a number to the PATCH level if we are between annotated tags, so makes it semver.org
compatible. Use the "-ldflags" method that also works with go 1.17.
* Use Makefile bash and sed magic to do PATCH level increase if needed.
Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
* Add "client-cert" and "client-key" flag options to allow the checker to use TLS client certificate for authentication.
* Fix typo TSL -> TLS in docs.
Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
* Add "client-cert" and "client-key" flag options to allow the uploader to use
TLS client certificate for authentication with the provider.
Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
