hotfix: GLPI Agent 1.6.1 release

fix: Fix SSL connection regression introduced in GLPI Agent 1.6
Closes #530

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -75,6 +75,7 @@ body:
       label: GLPI Agent version
       description: What GLPI agent version is triggering this issue ?
       options:
+        - 1.6.1
         - 1.6
         - 1.5
         - 1.4

Changes

@@ -2,6 +2,14 @@ Revision history for GLPI agent
 
 1.7 not yet released
 
+1.6.1 Fri, 17 Nov 2023
+
+core:
+* fix #530: Also include Mozilla::CA default store when including windows keystore
+  or macosx keychains certificates as IO::Socket::SSL can't no more use them since
+  LWP::Protocol::https update.
+  This fixes SSL connection issues appeared with 1.6 release.
+
 1.6 Wed, 15 Nov 2023
 
 core:

Makefile.PL

@@ -14,7 +14,7 @@ include 'Module::AutoInstall';
 abstract 'GLPI unified Agent for UNIX, Linux, Windows and MacOSX';
 license 'gpl';
 repository 'https://github.com/glpi-project/glpi-agent';
-version '1.7-dev';
+version '1.6.1';
 perl_version '5.008';
 authors 'Teclib Editions';
 

contrib/windows/glpi-agent-deployment.vbs

@@ -64,7 +64,7 @@ Dim Setup, SetupArchitecture, SetupLocation, SetupNightlyLocation, SetupOptions,
 ' SetupVersion
 '    Setup version with the pattern <major>.<minor>.<release>[-<package>]
 '
-SetupVersion = "1.6"
+SetupVersion = "1.6.1"
 
 ' When using a nightly built version, uncomment the following SetupVersion definition line
 ' replacing gitABCDEFGH with the most recent git revision found on the nightly builds site

debian/changelog

@@ -1,3 +1,9 @@
+glpi-agent (1:1.6.1-1) unstable; urgency=medium
+
+  * New upstream release 1.6.1
+
+ -- Guillaume Bougard <[email protected]>  Fri, 17 Nov 2023 16:14:00 +0100
+
 glpi-agent (1:1.6-1) unstable; urgency=medium
 
   * New upstream release 1.6

lib/GLPI/Agent/HTTP/Client.pm

@@ -377,6 +377,10 @@ sub _KeyChain_or_KeyStore_Export {
     return $_SSL_ca->{_certs}
         if $_SSL_ca->{_expiration} && time < $_SSL_ca->{_expiration};
 
+    # Free stored certificates
+    IO::Socket::SSL::Utils::CERT_free(@{$_SSL_ca->{_certs}})
+        if ref($_SSL_ca->{_certs}) eq 'ARRAY';
+
     $logger->debug(
         _log_prefix .
         ($_SSL_ca ? "Updating" : "Reading") . " $basename known certificates"
@@ -476,6 +480,13 @@ sub _KeyChain_or_KeyStore_Export {
         }
     }
 
+    # Always include default CA file from Mozilla::CA
+    if (Mozilla::CA->require()) {
+        my $cacert = Mozilla::CA::SSL_ca_file();
+        push @certs, IO::Socket::SSL::Utils::PEM_file2certs($cacert)
+            if -e $cacert;
+    }
+
     # Update class level datas
     $_SSL_ca->{_expiration} = time + 3600;
     return $_SSL_ca->{_certs} = \@certs;
@@ -557,6 +568,12 @@ sub _uncompressGzip {
     return $result;
 }
 
+sub END {
+    # Free eventually stored certificates
+    IO::Socket::SSL::Utils::CERT_free(@{$_SSL_ca->{_certs}})
+        if ref($_SSL_ca->{_certs}) eq 'ARRAY';
+}
+
 1;
 __END__
 

lib/GLPI/Agent/Version.pm

@@ -3,7 +3,7 @@ package GLPI::Agent::Version;
 use strict;
 use warnings;
 
-our $VERSION = "1.7-dev";
+our $VERSION = "1.6.1";
 our $PROVIDER = "GLPI";
 our $COMMENTS = [];
 
@@ -31,5 +31,5 @@ agent issue is reported.
 One very useful information should be first defined like in that example:
 
 our $COMMENTS = [
-    "Based on GLPI Agent 1.7-dev"
+    "Based on GLPI Agent 1.6.1"
 ];