Use ssl.PROTOCOL_TLS_CLIENT for forward-compatible TLS negotiation#86
Merged
Conversation
Merged
…ersion negotiation Co-authored-by: DaTiC0 <13198638+DaTiC0@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Update workflow hardening implementation based on feedback
Use ssl.PROTOCOL_TLS_CLIENT for forward-compatible TLS negotiation
Mar 7, 2026
DaTiC0
marked this pull request as ready for review
March 7, 2026 14:54
DaTiC0
added a commit
that referenced
this pull request
Mar 7, 2026
* Add health checks, workflow guards, and secure repo tooling * Document safe recovery for accidental main commits * Fix/health endpoint abstraction, conditional TLS config, and git hook guard (#84) * Initial plan * Address review feedback: MQTT helper, conditional TLS version, git hook guard Co-authored-by: DaTiC0 <13198638+DaTiC0@users.noreply.github.com> * Remove unused mqtt import from routes.py (fixes DeepSource F401) Co-authored-by: DaTiC0 <13198638+DaTiC0@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: DaTiC0 <13198638+DaTiC0@users.noreply.github.com> * Fix incorrect exit code 5 handling in Makefile unittest fallback (#87) * Initial plan * Fix incorrect exit code 5 handling in unittest block of Makefile Co-authored-by: DaTiC0 <13198638+DaTiC0@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: DaTiC0 <13198638+DaTiC0@users.noreply.github.com> * Use ssl.PROTOCOL_TLS_CLIENT for forward-compatible TLS negotiation (#86) * Initial plan * Use ssl.PROTOCOL_TLS_CLIENT instead of ssl.PROTOCOL_TLSv1_2 for TLS version negotiation Co-authored-by: DaTiC0 <13198638+DaTiC0@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: DaTiC0 <13198638+DaTiC0@users.noreply.github.com> * Defensive parsing of MQTT_BROKER_PORT env var (#85) * Initial plan * Add _get_int_env helper for safe MQTT_BROKER_PORT parsing Co-authored-by: DaTiC0 <13198638+DaTiC0@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: DaTiC0 <13198638+DaTiC0@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: DaTiC0 <13198638+DaTiC0@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ssl.PROTOCOL_TLSv1_2withssl.PROTOCOL_TLS_CLIENTinconfig.pyfor MQTT TLS configurationPROTOCOL_TLSv1_2hardcodes TLS 1.2, blocking TLS 1.3 negotiation;PROTOCOL_TLS_CLIENTlets client/server negotiate the highest mutually supported versionValidation
make test)make health)AI-Assisted Review (if applicable)
Risk & Rollback
MQTT_TLS_VERSIONassignment tossl.PROTOCOL_TLSv1_2🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.