Chore/bisect

[danielbodnar]

This pull request introduces several foundational improvements to the BitBuilder Cloud CLI (bbctl) project, focusing on documentation, configuration, code quality, and initial planning. The changes establish a clear project structure, add configuration and linting for both Rust and TypeScript development, and provide comprehensive guides and plans for future development.

Project Planning and Documentation:

• Added a detailed implementation plan for bbctl, outlining architecture, phases, and directory structure in PLAN.md.
• Introduced an API documentation guide using Zod and OpenAPI in docs/api-readme.md, including instructions for schema validation, type safety, and client generation.
• Added a comprehensive configuration guide in docs/configuration-guide.md, covering all aspects of bbctl configuration, provider and credential management, and best practices.
• Expanded the main README.md with instructions for testing against a VyOS lab environment.

Development Environment and Tooling:

• Added .eslintrc.json for TypeScript linting with recommended rules and project-specific overrides.
• Introduced bunfig.toml to configure Bun for dependency management, testing, and building TypeScript code.
• Updated Cargo.toml to include the uuid crate for networking and security features, preparing for future API and RPC additions.

Developer Experience and Guidelines:

• Enhanced CLAUDE.md with more detailed build, test, and style guidelines, including project structure, code formatting, and naming conventions. [1] [2] [3] [4]

These changes lay the groundwork for robust development practices, clear documentation, and a maintainable codebase as bbctl evolves.

[Copilot]

Pull Request Overview

This PR adds a comprehensive VyOS test lab infrastructure with Docker-based deployment scripts, network configuration, and integration documentation for the bbctl CLI. The changes primarily introduce new test infrastructure files and documentation to support multi-tenant networking scenarios.

Key Changes

• Added Docker-based VyOS test lab setup with automated provisioning scripts
• Introduced network configuration files for L3VPN/EVPN, WireGuard, and OSPF
• Added comprehensive documentation for VyOS networking and test lab setup
• Created TypeScript schema definitions and OpenAPI integration files

Reviewed Changes

Copilot reviewed 57 out of 61 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/vyos-lab/setup-lab.sh	Main orchestration script for VyOS lab deployment with router configuration
tests/vyos-lab/scripts/*.sh	Individual setup scripts for base infrastructure, containers, L3VPN, and WireGuard
tests/vyos-lab/README.md	Documentation for the VyOS test lab environment
docs/vyos-*.md	Comprehensive networking architecture and test lab documentation
src/main.rs	Added TestVyOS command for connectivity testing
schema.ts	TypeScript/Zod schemas for API validation
package.json	Added npm scripts and dependencies for TypeScript tooling

Comments suppressed due to low confidence (6)

src/main.rs:1

• The TestVyOS command destructuring pattern is missing several fields that are defined in the command struct (password, key_path, api_key). This will cause a compilation error. Include all fields in the destructuring pattern or use .. to ignore unused fields.
  src/main.rs:1
• [nitpick] The default host IP '5.254.54.3' appears to be a public IP address that may not be appropriate as a default value. Consider using 'localhost' or a more generic local IP address as the default.
  tests/vyos-lab/setup-lab.sh:1
• The script references ${SCRIPT_DIR}/scripts/ but SCRIPT_DIR is defined relative to the current script location. The scripts directory should exist at ${SCRIPT_DIR}/scripts/, but the actual scripts are in a sibling 'scripts' directory based on the file structure. This path should be verified or corrected.
  tests/vyos-lab/scripts/setup-base.sh:1
• Hardcoded interface name 'eth0' may not exist on all systems. Consider detecting the default route interface dynamically using ip route show default | awk '{print $5}' or making it configurable.
  tests/vyos-lab/scripts/configure-wireguard.sh:1
• The regex pattern for extracting the WireGuard private key expects exactly 43 characters, but WireGuard keys are base64-encoded 32-byte values resulting in 44 characters (including padding). The pattern should be [A-Za-z0-9+/=]\{44\} to correctly match WireGuard keys.
  tests/vyos-lab/scripts/setup-vyos-container.sh:1
• The encrypted password hash is exposed in plain text in the configuration script. While this is a test environment, it's better practice to generate unique passwords per deployment or document that this is the hash for the default 'vyos' password.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The CIDR regex validation only checks the format but doesn't validate that octets are in the valid range (0-255) or that the prefix length is valid (0-32 for IPv4). Consider using a more robust validation or IP validation library to prevent invalid CIDR blocks like '999.999.999.999/99'.

[Copilot]

Pull request overview

Copilot reviewed 57 out of 61 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (8)

vyos-lab/setup-network.sh:1

• The hardcoded absolute path /home/bodnar/vyos-lab makes this script non-portable. Use $(dirname "$0") or a relative path to make the script work for other users and environments.
  vyos-lab/mkosi.default:1
• Hardcoded path contains a specific username 'bodnar'. This should use a relative path or environment variable to ensure portability across different user environments.
  tests/vyos-lab/setup-lab.sh:1
• The default host IP 5.254.54.3 appears to be a public IP address. For a test lab, consider using private IP ranges (e.g., 192.168.x.x or 10.x.x.x) to avoid potential conflicts with real public IPs.
  tests/vyos-lab/scripts/setup-base.sh:1
• The script assumes network interface eth0 exists. Modern systems may use different interface naming schemes (e.g., ens33, enp0s3). Consider detecting the default interface dynamically or documenting this assumption.
  tests/vyos-lab/scripts/setup-vyos-container.sh:1
• Using a hardcoded password hash in test scripts is a security concern if these scripts are ever used in non-test environments. Add a prominent comment warning that this is for testing only, or better yet, generate unique passwords per deployment.
  src/main.rs:1
• The error message refers to implementation details ('tokio runtime') that may confuse users. This appears to be a placeholder that returns an error, but the actual implementation exists later in main(). Consider removing this unreachable code path or updating the comment to clarify the control flow.
  src/network.rs:1
• The code accesses config.port with unwrap_or(), but the WireguardConfig struct defines port as a non-optional u16 field. This suggests either the struct definition is incorrect or this code is outdated. The struct should have port: Option<u16> if this fallback is intended.
  src/services/instance.rs:1
• The hardcoded node name 'pve' is a placeholder that could cause issues in production. This should either retrieve the actual node name from the instance metadata or be documented as a limitation that requires configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The package requires Bun >=1.0.0 but doesn't document this requirement prominently in the README or installation instructions. Users following the installation guide might not realize they need Bun installed.

[Copilot]

Pull request overview

Copilot reviewed 45 out of 50 changed files in this pull request and generated 21 comments.

Comments suppressed due to low confidence (2)

package.json:58

• package.json has an extra closing brace at the end, making the JSON invalid and breaking installs/tooling. Remove the trailing } so the file ends with a single top-level object close.

}
}

docs/api-readme.md:37

• The OpenAPI generation instructions include duplicated headings and a malformed code fence (an opening bash, then bullet text, then another bash). This breaks Markdown rendering and makes the instructions hard to follow. Remove the duplicated prerequisite/install blocks and use a single properly-delimited code fence for commands.

- Bun 1.0 or higher

### Installation

```bash
-   Bun 1.0 or higher

### Installation

```bash
cd bitbuilder.io/bbctl
bun install

</details>



---

💡 <a href="/bitbuilder-io/bbctl/new/main?filename=.github/instructions/*.instructions.md" class="Link--inTextBlock" target="_blank" rel="noopener noreferrer">Add Copilot custom instructions</a> for smarter, more guided reviews. <a href="https://docs.github.com/en/copilot/customizing-copilot/adding-repository-custom-instructions-for-github-copilot" class="Link--inTextBlock" target="_blank" rel="noopener noreferrer">Learn how to get started</a>.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​tokio@​1.43.0 ⏵ 1.49.0	-2	+1
	cargo/​assert_cmd@​2.0.16 ⏵ 2.1.2
	cargo/​openssl@​0.10.71 ⏵ 0.10.75		+2
	cargo/​anyhow@​1.0.97 ⏵ 1.0.100
	cargo/​serde@​1.0.210 ⏵ 1.0.228
	cargo/​serde_json@​1.0.140 ⏵ 1.0.149
	cargo/​toml@​0.8.20 ⏵ 0.8.23
	cargo/​mockito@​1.6.1 ⏵ 1.7.1
	cargo/​uuid@​1.15.1 ⏵ 1.19.0
	cargo/​log@​0.4.20 ⏵ 0.4.29
	cargo/​tempfile@​3.17.1 ⏵ 3.24.0
	cargo/​clap@​4.5.31 ⏵ 4.5.54
	cargo/​chrono@​0.4.40 ⏵ 0.4.43

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		System shell access: cargo darling_core Location: Package overview From: ? → cargo/ratatui@0.29.0 → cargo/darling_core@0.23.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/darling_core@0.23.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: cargo r-efi Location: Package overview From: ? → cargo/tempfile@3.24.0 → cargo/mockito@1.7.1 → cargo/uuid@1.19.0 → cargo/r-efi@5.3.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/r-efi@5.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: cargo syn Location: Package overview From: ? → cargo/clap@4.5.54 → cargo/tokio@1.49.0 → cargo/serde_json@1.0.149 → cargo/chrono@0.4.43 → cargo/indicatif@0.17.11 → cargo/futures@0.3.31 → cargo/dirs@5.0.1 → cargo/reqwest@0.11.27 → cargo/ratatui@0.29.0 → cargo/serde@1.0.228 → cargo/openssl@0.10.75 → cargo/mockito@1.7.1 → cargo/uuid@1.19.0 → cargo/syn@2.0.114 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/syn@2.0.114. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: cargo zerocopy-derive Location: Package overview From: ? → cargo/mockito@1.7.1 → cargo/zerocopy-derive@0.8.33 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy-derive@0.8.33. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo find-msvc-tools Location: Package overview From: ? → cargo/chrono@0.4.43 → cargo/reqwest@0.11.27 → cargo/openssl@0.10.75 → cargo/find-msvc-tools@0.1.7 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/find-msvc-tools@0.1.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo hyper-util Location: Package overview From: ? → cargo/mockito@1.7.1 → cargo/hyper-util@0.1.19 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/hyper-util@0.1.19. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo icu_normalizer_data Location: Package overview From: ? → cargo/reqwest@0.11.27 → cargo/icu_normalizer_data@2.1.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/icu_normalizer_data@2.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo icu_properties_data Location: Package overview From: ? → cargo/reqwest@0.11.27 → cargo/icu_properties_data@2.1.2 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/icu_properties_data@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo quote Location: Package overview From: ? → cargo/clap@4.5.54 → cargo/tokio@1.49.0 → cargo/serde_json@1.0.149 → cargo/chrono@0.4.43 → cargo/indicatif@0.17.11 → cargo/futures@0.3.31 → cargo/dirs@5.0.1 → cargo/reqwest@0.11.27 → cargo/ratatui@0.29.0 → cargo/serde@1.0.228 → cargo/openssl@0.10.75 → cargo/mockito@1.7.1 → cargo/uuid@1.19.0 → cargo/quote@1.0.43 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/quote@1.0.43. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo r-efi Location: Package overview From: ? → cargo/tempfile@3.24.0 → cargo/mockito@1.7.1 → cargo/uuid@1.19.0 → cargo/r-efi@5.3.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/r-efi@5.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo serde_core Location: Package overview From: ? → cargo/serde_json@1.0.149 → cargo/serde@1.0.228 → cargo/uuid@1.19.0 → cargo/serde_core@1.0.228 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/serde_core@1.0.228. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo serde_derive Location: Package overview From: ? → cargo/serde_json@1.0.149 → cargo/serde@1.0.228 → cargo/uuid@1.19.0 → cargo/serde_derive@1.0.228 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/serde_derive@1.0.228. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo wasm-bindgen-macro-support Location: Package overview From: ? → cargo/chrono@0.4.43 → cargo/indicatif@0.17.11 → cargo/reqwest@0.11.27 → cargo/uuid@1.19.0 → cargo/wasm-bindgen-macro-support@0.2.107 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/wasm-bindgen-macro-support@0.2.107. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo wasm-bindgen Location: Package overview From: ? → cargo/chrono@0.4.43 → cargo/indicatif@0.17.11 → cargo/reqwest@0.11.27 → cargo/uuid@1.19.0 → cargo/wasm-bindgen@0.2.107 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/wasm-bindgen@0.2.107. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo wit-bindgen Location: Package overview From: ? → cargo/tempfile@3.24.0 → cargo/mockito@1.7.1 → cargo/uuid@1.19.0 → cargo/wit-bindgen@0.46.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/wit-bindgen@0.46.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo zerocopy-derive Location: Package overview From: ? → cargo/mockito@1.7.1 → cargo/zerocopy-derive@0.8.33 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy-derive@0.8.33. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: cargo zmij Location: Package overview From: ? → cargo/serde_json@1.0.149 → cargo/zmij@1.0.14 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zmij@1.0.14. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

In general, to fix this problem, the HTTP client must never disable TLS certificate validation in production code. Instead of toggling danger_accept_invalid_certs(true) at runtime, certificate verification should remain enabled (the default), and any special handling for lab/dev environments should be implemented in a safer way (for example, by using proper test certificates or environment‑specific roots, not by disabling validation).

The best fix here, without changing existing functionality more than necessary, is to remove the call to danger_accept_invalid_certs(true) entirely and rely on the default behavior of reqwest::Client::builder(), which is to validate certificates. If you still want an explicit link between verify_ssl and client behavior, you can set danger_accept_invalid_certs(false) when verify_ssl is true, but that is redundant and not required for correctness. Since we cannot change the rest of the code and want a minimal, safe change, we will simply delete the conditional block that disables TLS verification and leave the rest of init_http_client intact. No new imports, methods, or definitions are needed; the change is localized to init_http_client in src/api/vyos.rs, lines 116–119.