add verify_ssl constructor param, bump version to 11.1.0

Adds a `verify_ssl` keyword argument to the CloudCheck constructor
(Rust `with_config` + PyO3 binding) mapping to reqwest's
`danger_accept_invalid_certs`. Lets callers disable SSL verification
when fetching cloud provider signatures (corporate proxies, custom CAs,
SSL-intercepting infrastructure). Defaults to True.

Closes #272; unblocks bbot#3226 (ssl_verify_infrastructure passthrough).

- src/lib.rs: verify_ssl field; build a reqwest::Client with
  danger_accept_invalid_certs(!verify_ssl) instead of the default client;
  warn when verification is disabled
- src/python.rs: verify_ssl=None kwarg passed through to with_config
- bump 11.0.0 -> 11.1.0 (Cargo.toml, pyproject.toml, lockfiles)
- docker-tests.yml: image tags v11.0/v11.0.0 -> v11.1/v11.1.0
- tests: Rust + Python coverage for verify_ssl=False

Author: liquidsec

.github/workflows/docker-tests.yml

@@ -61,8 +61,8 @@ jobs:
           type=sha,prefix=sha-
           type=raw,value=latest,enable={{is_default_branch}}
           type=raw,value=v11
-          type=raw,value=v11.0
-          type=raw,value=v11.0.0
+          type=raw,value=v11.1
+          type=raw,value=v11.1.0
 
     - name: Build and push Docker image
       uses: docker/build-push-action@v7

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "cloudcheck"
-version = "11.0.0"
+version = "11.1.0"
 edition = "2024"
 description = "CloudCheck is a simple Rust tool to check whether an IP address or hostname belongs to a cloud provider."
 license = "GPL-3.0"

Cargo.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cloudcheck"
-version = "11.0.0"
+version = "11.1.0"
 description = "Detailed database of cloud providers. Instantly look up a domain or IP address"
 readme = "README.md"
 requires-python = ">=3.10"

pyproject.toml

@@ -47,6 +47,7 @@ pub struct CloudCheck {
     max_retries: u32,
     retry_delay_seconds: u64,
     force_refresh: bool,
+    verify_ssl: bool,
 }
 
 impl Default for CloudCheck {
@@ -57,14 +58,15 @@ impl Default for CloudCheck {
 
 impl CloudCheck {
     pub fn new() -> Self {
-        Self::with_config(None, None, None, None)
+        Self::with_config(None, None, None, None, None)
     }
 
     pub fn with_config(
         signature_url: Option<String>,
         max_retries: Option<u32>,
         retry_delay_seconds: Option<u64>,
         force_refresh: Option<bool>,
+        verify_ssl: Option<bool>,
     ) -> Self {
         let url = signature_url
             .or_else(|| std::env::var("CLOUDCHECK_SIGNATURE_URL").ok())
@@ -78,6 +80,7 @@ impl CloudCheck {
             max_retries: max_retries.unwrap_or(10),
             retry_delay_seconds: retry_delay_seconds.unwrap_or(1),
             force_refresh: force_refresh.unwrap_or(false),
+            verify_ssl: verify_ssl.unwrap_or(true),
         }
     }
 
@@ -95,17 +98,28 @@ impl CloudCheck {
         let max_retries = self.max_retries;
         let retry_delay_seconds = self.retry_delay_seconds;
         log::info!(
-            "Fetching data from URL: {} (max_retries={}, retry_delay={}s)",
+            "Fetching data from URL: {} (max_retries={}, retry_delay={}s, verify_ssl={})",
             url,
             max_retries,
-            retry_delay_seconds
+            retry_delay_seconds,
+            self.verify_ssl
         );
 
+        if !self.verify_ssl {
+            log::warn!(
+                "SSL certificate verification is DISABLED for cloud provider signature fetch"
+            );
+        }
+        let client = reqwest::Client::builder()
+            .danger_accept_invalid_certs(!self.verify_ssl)
+            .build()
+            .map_err(|e| Box::new(e) as Error)?;
+
         let mut last_error = None;
 
         for attempt in 0..=max_retries {
             log::info!("Fetch attempt {}/{}", attempt + 1, max_retries + 1);
-            let result = match reqwest::get(url).await {
+            let result = match client.get(url).send().await {
                 Ok(response) => {
                     let status = response.status();
                     log::info!(
@@ -479,6 +493,19 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn test_lookup_with_ssl_verification_disabled() {
+        // verify_ssl=false should still succeed against a host with a valid cert
+        let cloudcheck = CloudCheck::with_config(None, None, None, Some(true), Some(false));
+        let results = cloudcheck.lookup("8.8.8.8").await.unwrap();
+        let names: Vec<String> = results.iter().map(|p| p.name.clone()).collect();
+        assert!(
+            names.contains(&"Google".to_string()),
+            "Expected Google in results: {:?}",
+            names
+        );
+    }
+
     #[tokio::test]
     async fn test_lookup_windows_blob_domain() {
         let cloudcheck = CloudCheck::new();

src/lib.rs

@@ -20,19 +20,21 @@ pub struct CloudCheck {
 #[pymethods]
 impl CloudCheck {
     #[new]
-    #[pyo3(signature = (signature_url=None, max_retries=None, retry_delay_seconds=None, force_refresh=None))]
+    #[pyo3(signature = (signature_url=None, max_retries=None, retry_delay_seconds=None, force_refresh=None, verify_ssl=None))]
     fn new(
         signature_url: Option<String>,
         max_retries: Option<u32>,
         retry_delay_seconds: Option<u64>,
         force_refresh: Option<bool>,
+        verify_ssl: Option<bool>,
     ) -> Self {
         CloudCheck {
             inner: RustCloudCheck::with_config(
                 signature_url,
                 max_retries,
                 retry_delay_seconds,
                 force_refresh,
+                verify_ssl,
             ),
         }
     }

src/python.rs

@@ -20,6 +20,15 @@ async def test_lookup_amazon_domain():
     assert "Amazon" in names, f"Expected Amazon in results: {names}"
 
 
+@pytest.mark.asyncio
+async def test_lookup_with_ssl_verification_disabled():
+    """verify_ssl=False should still succeed against a host with a valid cert"""
+    cloudcheck = CloudCheck(verify_ssl=False)
+    results = await cloudcheck.lookup("8.8.8.8")
+    names = [provider["name"] for provider in results]
+    assert "Google" in names, f"Expected Google in results: {names}"
+
+
 @pytest.mark.asyncio
 async def test_lookup_with_invalid_url():
     """Test that lookup raises RuntimeError with proper message when URL is invalid"""