Skip to content

chore(ci): remove NODE_TLS_REJECT_UNAUTHORIZED=0 workaround once Aztec fixes expired CRS cert #1568

Description

@coderabbitai

Context

In PR #1567 (and the build_sdk job in .github/workflows/ci.yml), NODE_TLS_REJECT_UNAUTHORIZED=0 was set for the test:sdk matrix case in the crisp_unit job and for pnpm sdk:test in the build_sdk job.

This was necessary because @aztec/bb.js downloads the public Aztec Common Reference String (CRS) via Barretenberg.initSRSChonk over TLS (called in examples/CRISP/packages/crisp-sdk/src/vote.ts and packages/enclave-sdk/src/crypto/user-data-encryption.ts), and some CI runners reject the served TLS certificate as expired (CERT_HAS_EXPIRED).

Workaround

# .github/workflows/ci.yml (crisp_unit job)
NODE_TLS_REJECT_UNAUTHORIZED: ${{ matrix.test-suite == 'test:sdk' && '0' || '1' }}

# .github/workflows/ci.yml (build_sdk job)
NODE_TLS_REJECT_UNAUTHORIZED: '0'

Action Required

Once the TLS certificate for the Aztec CRS endpoint is renewed/fixed upstream (on Aztec's side), this workaround should be removed:

  1. Remove the NODE_TLS_REJECT_UNAUTHORIZED: '0' env variable from the crisp_unit / test:sdk matrix case.
  2. Remove the NODE_TLS_REJECT_UNAUTHORIZED: '0' env variable from the build_sdk Run the tests step.
  3. Verify CI passes without the bypass.

References

Reported by @ctrlc03

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions