Add flag to insecurely skip certificate validation

CHANGELOG.md

@@ -13,6 +13,8 @@ All notable changes to `src-cli` are documented in this file.
 
 ### Added
 
+- Added a flag `-insecure-skip-verify` to disable TLS certificate validation.
+
 ### Changed
 
 - Deprecated cache file formats are not read by `src campaign [apply|preview]` anymore.

cmd/src/version.go

@@ -60,7 +60,7 @@ func getRecommendedVersion(ctx context.Context, client api.Client) (string, erro
 		return "", err
 	}
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := client.Do(req)
 	if err != nil {
 		return "", err
 	}

internal/api/api.go

@@ -4,6 +4,7 @@ package api
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -39,6 +40,9 @@ type Client interface {
 	// path is joined against the API route. For example on Sourcegraph.com this
 	// will result the URL: https://sourcegraph.com/.api/path.
 	NewHTTPRequest(ctx context.Context, method, path string, body io.Reader) (*http.Request, error)
+
+	// Do runs an http.Request against the Sourcegraph API.
+	Do(req *http.Request) (*http.Response, error)
 }
 
 // Request instances represent GraphQL requests.
@@ -59,7 +63,8 @@ type Request interface {
 
 // client is the internal concrete type implementing Client.
 type client struct {
-	opts ClientOpts
+	opts       ClientOpts
+	httpClient *http.Client
 }
 
 // request is the internal concrete type implementing Request.
@@ -96,6 +101,13 @@ func NewClient(opts ClientOpts) Client {
 		flags = defaultFlags()
 	}
 
+	httpClient := http.DefaultClient
+	if flags.insecureSkipVerify != nil && *flags.insecureSkipVerify {
+		httpClient = &http.Client{
+			Transport: &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}},
+		}
+	}
+
 	return &client{
 		opts: ClientOpts{
 			Endpoint:          opts.Endpoint,
@@ -104,6 +116,7 @@ func NewClient(opts ClientOpts) Client {
 			Flags:             flags,
 			Out:               opts.Out,
 		},
+		httpClient: httpClient,
 	}
 }
 
@@ -132,6 +145,10 @@ func (c *client) NewGzippedQuery(query string) Request {
 	return c.NewGzippedRequest(query, nil)
 }
 
+func (c *client) Do(req *http.Request) (*http.Response, error) {
+	return c.httpClient.Do(req)
+}
+
 func (c *client) NewHTTPRequest(ctx context.Context, method, p string, body io.Reader) (*http.Request, error) {
 	req, err := c.createHTTPRequest(ctx, method, p, body)
 	if err != nil {
@@ -209,7 +226,7 @@ func (r *request) do(ctx context.Context, result interface{}) (bool, error) {
 	}
 
 	// Perform the request.
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := r.client.httpClient.Do(req)
 	if err != nil {
 		return false, err
 	}

internal/api/flags.go

@@ -5,26 +5,29 @@ import "flag"
 // Flags encapsulates the standard flags that should be added to all commands
 // that issue API requests.
 type Flags struct {
-	dump    *bool
-	getCurl *bool
-	trace   *bool
+	dump               *bool
+	getCurl            *bool
+	trace              *bool
+	insecureSkipVerify *bool
 }
 
 // NewFlags instantiates a new Flags structure and attaches flags to the given
 // flag set.
 func NewFlags(flagSet *flag.FlagSet) *Flags {
 	return &Flags{
-		dump:    flagSet.Bool("dump-requests", false, "Log GraphQL requests and responses to stdout"),
-		getCurl: flagSet.Bool("get-curl", false, "Print the curl command for executing this query and exit (WARNING: includes printing your access token!)"),
-		trace:   flagSet.Bool("trace", false, "Log the trace ID for requests. See https://docs.sourcegraph.com/admin/observability/tracing"),
+		dump:               flagSet.Bool("dump-requests", false, "Log GraphQL requests and responses to stdout"),
+		getCurl:            flagSet.Bool("get-curl", false, "Print the curl command for executing this query and exit (WARNING: includes printing your access token!)"),
+		trace:              flagSet.Bool("trace", false, "Log the trace ID for requests. See https://docs.sourcegraph.com/admin/observability/tracing"),
+		insecureSkipVerify: flagSet.Bool("insecure-skip-verify", false, "Skip validating x.509 certificates against trusted chains"),
 	}
 }
 
 func defaultFlags() *Flags {
 	d := false
 	return &Flags{
-		dump:    &d,
-		getCurl: &d,
-		trace:   &d,
+		dump:               &d,
+		getCurl:            &d,
+		trace:              &d,
+		insecureSkipVerify: &d,
 	}
 }

internal/campaigns/repo_fetcher.go

@@ -303,7 +303,7 @@ func fetchRepositoryFile(ctx context.Context, client api.Client, repo *graphql.R
 		req.Header.Set("Accept", "application/zip")
 	}
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := client.Do(req)
 	if err != nil {
 		return false, err
 	}