[git] add SSL verification configuration option

Author: FrogDevelopper

consul-populate-core/src/main/java/com/frogdevelopment/consul/populate/git/GitFactory.java

@@ -2,6 +2,14 @@
 
 import lombok.extern.slf4j.Slf4j;
 
+import java.security.KeyManagementException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.X509Certificate;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+
 import jakarta.inject.Singleton;
 
 import org.eclipse.jgit.api.Git;
@@ -39,17 +47,24 @@ public class GitFactory {
     public Git git(final GitProperties gitProperties,
                    final RepositoryDirectoryProvider repositoryDirectoryProvider) throws GitAPIException {
         final var credentialsProvider = createCredentialsProvider(gitProperties);
-//        CredentialsProvider.setDefault(credentialsProvider);
+        CredentialsProvider.setDefault(credentialsProvider);
         final var repositoryDirectory = repositoryDirectoryProvider.getRepository();
 
+        // Configure SSL verification
+        if (!gitProperties.isSslVerify()) {
+            log.warn("SSL verification is disabled for git repository [{}]. This is insecure and should only be used in development!",
+                    gitProperties.getUri());
+            configureInsecureSSL();
+        }
+
         log.debug("Cloning repository [{}]", gitProperties.getUri());
         return Git.cloneRepository()
                 .setURI(gitProperties.getUri())
                 .setDirectory(repositoryDirectory.toFile())
                 .setGitDir(repositoryDirectory.resolve(Constants.DOT_GIT).toFile())
                 .setBranch(gitProperties.getBranch())
                 .setRemote(Constants.DEFAULT_REMOTE_NAME)
-                .setCredentialsProvider(credentialsProvider)
+//                .setCredentialsProvider(credentialsProvider)
                 .call();
     }
 
@@ -62,4 +77,45 @@ private static CredentialsProvider createCredentialsProvider(final GitProperties
         }
     }
 
+    /**
+     * Configures JGit to skip SSL certificate verification.
+     * This creates a trust manager that accepts all certificates and installs it as the default.
+     * <p>
+     * WARNING: This is insecure and should only be used in development/testing environments
+     * with self-signed certificates or internal CAs.
+     */
+    private static void configureInsecureSSL() {
+        try {
+            // Create a trust manager that accepts all certificates
+            final var trustAllCerts = new TrustManager[]{
+                    new X509TrustManager() {
+                        @Override
+                        public X509Certificate[] getAcceptedIssuers() {
+                            return new X509Certificate[0];
+                        }
+
+                        @Override
+                        public void checkClientTrusted(X509Certificate[] certs, String authType) {
+                        }
+
+                        @Override
+                        public void checkServerTrusted(X509Certificate[] certs, String authType) {
+                        }
+                    }
+            };
+
+            // Install the all-trusting trust manager
+            final var sslContext = SSLContext.getInstance("TLS");
+            sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
+
+            // Set default SSL context for HTTPS connections
+            HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
+            HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true);
+
+        } catch (NoSuchAlgorithmException | KeyManagementException e) {
+            log.error("Failed to configure insecure SSL", e);
+            throw new RuntimeException("Failed to configure SSL for git operations", e);
+        }
+    }
+
 }

consul-populate-core/src/main/java/com/frogdevelopment/consul/populate/git/GitProperties.java

@@ -48,6 +48,9 @@ public class GitProperties {
     /** Local directory path where the repository will be cloned (default: /tmp) */
     private Path localPath = Path.of("/tmp");
 
+    /** Whether to verify SSL certificates (default: true). Set to false for self-signed certificates */
+    private boolean sslVerify = true;
+
     /** Polling configuration for detecting repository changes */
     private Polling polling = new Polling();