fix: add certifi (#42)

codedge-llc · Mar 5, 2021 · 0cedd74 · 0cedd74
1 parent 3e2aa75
commit 0cedd74
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## v0.6.0
+
+**Security**
+
+- Verify CA certificates with `:certifi` (~> 2.5) by default. This is considered a breaking change
+  for anyone using Kadabra for anything other than [Pigeon](https://github.com/codedge-llc/pigeon).
+
 ## v0.5.0
 
 **Changed**

diff --git a/README.md b/README.md
@@ -18,7 +18,7 @@ Add kadabra to your `mix.exs`:
 ```elixir
 def deps do
   [
-    {:kadabra, "~> 0.5.0"}
+    {:kadabra, "~> 0.6.0"}
   ]
 end
 ```

diff --git a/lib/socket.ex b/lib/socket.ex
@@ -83,6 +83,9 @@ defmodule Kadabra.Socket do
         {:active, :once},
         {:packet, :raw},
         {:reuseaddr, false},
+        {:verify, :verify_peer},
+        {:depth, 99},
+        {:cacerts, :certifi.cacerts()},
         {:alpn_advertised_protocols, [<<"h2">>]},
         :binary
       ]

diff --git a/mix.exs b/mix.exs
@@ -1,7 +1,7 @@
 defmodule Kadabra.Mixfile do
   use Mix.Project
 
-  @version "0.5.0"
+  @version "0.6.0"
 
   def project do
     [
@@ -44,6 +44,7 @@ defmodule Kadabra.Mixfile do
 
   defp deps do
     [
+      {:certifi, "~> 2.5"},
       {:credo, "~> 1.0", only: [:dev, :test], runtime: false},
       {:dialyxir, "~> 1.0", only: [:dev], runtime: false},
       {:ex_doc, ">= 0.0.0", only: :dev, runtime: false},