feat: add ssl certs for snap (#4380)

sweatybridge · web-flow · commit 891a5df91383 · 2025-10-29T15:17:32.000+08:00
diff --git a/internal/gen/types/templates/prod-ca-2025.crt b/internal/gen/types/templates/prod-ca-2025.crt
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDxzCCAq+gAwIBAgIUeX+gpfmsRW9asFkRvjyXjHxbfgcwDQYJKoZIhvcNAQEL
+BQAwazELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5l
+dyBDYXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEeMBwGA1UEAwwVU3VwYWJh
+c2UgUm9vdCAyMDIxIENBMB4XDTI1MDkwMzA4MDEyNVoXDTM1MDkwMTA4MDEyNVow
+azELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5ldyBD
+YXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEeMBwGA1UEAwwVU3VwYWJhc2Ug
+Um9vdCAyMDIxIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5Ve7
+i9UAmc7luUilELPtqzEk8nGHxg7nY0aCStr625M7+K4OPO6RUllTsHh47k1jWyzm
+LXLlyYwCsYCjQp+3vn06H+F/HRUxBt6CK2B7bNng230exTunk0xFvfkX6YgHR7B3
+1B7L25Rq3PhuRFPV4hnGYRam2XBZC4UNPqoAgrhV0HOYzXXAVoTr2yaBTMnB331Z
+RwOmINh7eqTCk/JRZbb6vfZOhZRAVAe9AoRLoG8aKwmeoLGwlu0UuFx6z3E+6bmA
+fSNa8Lx02GEoCdPLw9IRKUFq/SgBpQUKm44H1fDwTjH2CMM0N4p0mL/6wXnNeHvt
+C40MmKZ0RcVmHE5wBwIDAQABo2MwYTAdBgNVHQ4EFgQUjvEE541toZcwtXQlZlcB
+YOBRTnowHwYDVR0jBBgwFoAUjvEE541toZcwtXQlZlcBYOBRTnowDwYDVR0TAQH/
+BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggEBACD5IcGP
+XKvS9qg0CgEQPFqYavt5c7P+0xxFgiZe+xoG8fUw58yNeK2APtgGPRpxEOGfAlNx
+z9HDt4gcyHEE00B3qAVDm49pqNxioFWzNqU2LGfM/HL1QmN6urR7hCOkVCJddvOc
+FhFX4nZDuRfaBboDvS5HlK3Pzxddp9hvrJi2bemr8HLqYc3HzmVckgPGSLML6t+h
+4LRCXSlQsDgQ1LZ4KHsl4cq7K51N6FOXQBLB5q4lMKhs0VUhCT8Pdsj12+84laCV
+c22q6p2mdT9SaernCSRnWazXWisgpjv3H7Ex4S1DCYjJIwn3PUToGFv1r8YRN2/S
+O19yVSxxCIf64Sg=
+-----END CERTIFICATE-----
diff --git a/internal/gen/types/types.go b/internal/gen/types/types.go
@@ -114,14 +114,17 @@ var (
 	caStaging string
 	//go:embed templates/prod-ca-2021.crt
 	caProd string
+	//go:embed templates/prod-ca-2025.crt
+	caSnap string
 )
 
 func GetRootCA(ctx context.Context, dbURL string, options ...func(*pgx.ConnConfig)) (string, error) {
 	// node-postgres does not support sslmode=prefer
 	if require, err := isRequireSSL(ctx, dbURL, options...); !require {
 		return "", err
 	}
-	return caStaging + caProd, nil
+	// Merge all certs to support --db-url flag
+	return caStaging + caProd + caSnap, nil
 }
 
 func isRequireSSL(ctx context.Context, dbUrl string, options ...func(*pgx.ConnConfig)) (bool, error) {

Original file line number	Diff line number	Diff line change
`@@ -114,14 +114,17 @@ var (`
`114`	`114`	`caStaging string`
`115`	`115`	`//go:embed templates/prod-ca-2021.crt`
`116`	`116`	`caProd string`
	`117`	`+ //go:embed templates/prod-ca-2025.crt`
	`118`	`+ caSnap string`
`117`	`119`	`)`
`118`	`120`
`119`	`121`	`func GetRootCA(ctx context.Context, dbURL string, options ...func(*pgx.ConnConfig)) (string, error) {`
`120`	`122`	`// node-postgres does not support sslmode=prefer`
`121`	`123`	`if require, err := isRequireSSL(ctx, dbURL, options...); !require {`
`122`	`124`	`return "", err`
`123`	`125`	`}`
`124`		`- return caStaging + caProd, nil`
	`126`	`+ // Merge all certs to support --db-url flag`
	`127`	`+ return caStaging + caProd + caSnap, nil`
`125`	`128`	`}`
`126`	`129`
`127`	`130`	`func isRequireSSL(ctx context.Context, dbUrl string, options ...func(*pgx.ConnConfig)) (bool, error) {`