mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 09:06:14 +00:00
Tobias GesellchenandClaude Opus 4.7
ce3b0e582a
CodeQL alert 147 flagged the Phase-2 re-dial with InsecureSkipVerify=true, used to read the served leaf after Phase 1's strict verification failed. The leaf is already reachable without a second connection: tls.CertificateVerificationError carries UnverifiedCertificates, and the three x509.* verification- error types each carry the offending Cert. errors.As over those covers darwin (Security.framework) and linux (crypto/x509) consistently. Same three classifier outcomes (leafFromOwnCA/leafSubjectEqualsIssuer/leafForeign), same chainContext rendering — the classifier reads only the leaf, which is byte-identical to the Phase-2 peers[0]. Removes the only InsecureSkipVerify literal in the tree. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>