chore: cherry-pick fixes from main for 3.8.1 release

deny.toml

@@ -13,6 +13,9 @@ ignore = [
     # from object_store. We've removed our direct dependency and migrated to
     # rustls-pki-types. Remove once object_store updates.
     "RUSTSEC-2025-0134",
+    # bincode is considered complete at 1.3.3 and no longer maintained. It is
+    # past 1.0. Pulled into monolith via deps from iox.
+    "RUSTSEC-2025-0141",
 ]
 git-fetch-with-cli = true
 

influxdb3/src/commands/create.rs

@@ -31,15 +31,17 @@ pub struct Config {
 
 impl Config {
     fn get_client(&self) -> Result<Client, Box<dyn Error>> {
-        let (host_url, auth_token, ca_cert) = match &self.cmd {
+        let (host_url, auth_token, ca_cert, tls_no_verify) = match &self.cmd {
             SubCommand::Database(DatabaseConfig {
                 host_url,
                 auth_token,
                 ca_cert,
+                tls_no_verify,
                 ..
             })
             | SubCommand::LastCache(LastCacheConfig {
                 ca_cert,
+                tls_no_verify,
                 influxdb3_config:
                     InfluxDb3Config {
                         host_url,
@@ -50,6 +52,7 @@ impl Config {
             })
             | SubCommand::DistinctCache(DistinctCacheConfig {
                 ca_cert,
+                tls_no_verify,
                 influxdb3_config:
                     InfluxDb3Config {
                         host_url,
@@ -60,6 +63,7 @@ impl Config {
             })
             | SubCommand::Table(TableConfig {
                 ca_cert,
+                tls_no_verify,
                 influxdb3_config:
                     InfluxDb3Config {
                         host_url,
@@ -70,21 +74,23 @@ impl Config {
             })
             | SubCommand::Trigger(TriggerConfig {
                 ca_cert,
+                tls_no_verify,
                 influxdb3_config:
                     InfluxDb3Config {
                         host_url,
                         auth_token,
                         ..
                     },
                 ..
-            }) => (host_url, auth_token, ca_cert),
+            }) => (host_url, auth_token, ca_cert, tls_no_verify),
             SubCommand::Token(create_token_config) => {
                 let host_settings = create_token_config.get_connection_settings()?;
                 // We need to return references, so we'll handle this differently
                 return Ok({
                     let mut client = Client::new(
                         host_settings.host_url.clone(),
                         host_settings.ca_cert.clone(),
+                        host_settings.tls_no_verify,
                     )?;
                     if let Some(token) = &host_settings.auth_token {
                         client = client.with_auth_token(token.expose_secret());
@@ -94,7 +100,7 @@ impl Config {
             }
         };
 
-        let mut client = Client::new(host_url.clone(), ca_cert.clone())?;
+        let mut client = Client::new(host_url.clone(), ca_cert.clone(), *tls_no_verify)?;
         if let Some(token) = &auth_token {
             client = client.with_auth_token(token.expose_secret());
         }
@@ -147,6 +153,10 @@ pub struct DatabaseConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 #[derive(Debug, clap::Args)]
@@ -190,6 +200,10 @@ pub struct LastCacheConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 #[derive(Debug, clap::Args)]
@@ -227,6 +241,10 @@ pub struct DistinctCacheConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 #[derive(Debug, clap::Args)]
@@ -250,6 +268,10 @@ pub struct TableConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 #[derive(Debug, clap::Parser)]
@@ -291,6 +313,10 @@ pub struct TriggerConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 pub async fn command(config: Config) -> Result<(), Box<dyn Error>> {

influxdb3/src/commands/create/token.rs

@@ -201,6 +201,14 @@ pub struct InfluxDb3ServerConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(name = "tls-ca", long = "tls-ca")]
     pub ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(
+        name = "tls-no-verify",
+        long = "tls-no-verify",
+        env = "INFLUXDB3_TLS_NO_VERIFY"
+    )]
+    pub tls_no_verify: bool,
 }
 
 #[derive(Parser, Debug)]

influxdb3/src/commands/delete.rs

@@ -16,15 +16,17 @@ pub struct Config {
 
 impl Config {
     fn get_client(&self) -> Result<Client, Box<dyn Error>> {
-        match &self.cmd {
+        let (host_url, auth_token, ca_cert, tls_no_verify) = match &self.cmd {
             SubCommand::Database(DatabaseConfig {
                 host_url,
                 auth_token,
                 ca_cert,
+                tls_no_verify,
                 ..
             })
             | SubCommand::LastCache(LastCacheConfig {
                 ca_cert,
+                tls_no_verify,
                 influxdb3_config:
                     InfluxDb3Config {
                         host_url,
@@ -35,6 +37,7 @@ impl Config {
             })
             | SubCommand::DistinctCache(DistinctCacheConfig {
                 ca_cert,
+                tls_no_verify,
                 influxdb3_config:
                     InfluxDb3Config {
                         host_url,
@@ -45,6 +48,7 @@ impl Config {
             })
             | SubCommand::Table(TableConfig {
                 ca_cert,
+                tls_no_verify,
                 influxdb3_config:
                     InfluxDb3Config {
                         host_url,
@@ -55,6 +59,7 @@ impl Config {
             })
             | SubCommand::Trigger(TriggerConfig {
                 ca_cert,
+                tls_no_verify,
                 influxdb3_config:
                     InfluxDb3Config {
                         host_url,
@@ -65,17 +70,17 @@ impl Config {
             })
             | SubCommand::Token(TokenConfig {
                 ca_cert,
+                tls_no_verify,
                 host_url,
                 auth_token,
                 ..
-            }) => {
-                let mut client = Client::new(host_url.clone(), ca_cert.clone())?;
-                if let Some(token) = &auth_token {
-                    client = client.with_auth_token(token.expose_secret());
-                }
-                Ok(client)
-            }
+            }) => (host_url, auth_token, ca_cert, tls_no_verify),
+        };
+        let mut client = Client::new(host_url.clone(), ca_cert.clone(), *tls_no_verify)?;
+        if let Some(token) = &auth_token {
+            client = client.with_auth_token(token.expose_secret());
         }
+        Ok(client)
     }
 }
 
@@ -124,6 +129,10 @@ pub struct DatabaseConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 #[derive(Debug, clap::Args)]
@@ -142,6 +151,10 @@ pub struct LastCacheConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 #[derive(Debug, clap::Args)]
@@ -160,6 +173,10 @@ pub struct DistinctCacheConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 #[derive(Debug, clap::Args)]
@@ -178,6 +195,10 @@ pub struct TableConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 #[derive(Debug, clap::Parser)]
@@ -196,6 +217,10 @@ pub struct TriggerConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 #[derive(Debug, clap::Args)]
@@ -220,6 +245,10 @@ pub struct TokenConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 fn parse_hard_delete_time(value: Option<String>) -> Option<HardDeletionTime> {

influxdb3/src/commands/disable.rs

@@ -11,19 +11,20 @@ pub struct Config {
 
 impl Config {
     fn get_client(&self) -> Result<Client, Box<dyn Error>> {
-        let (host_url, auth_token, ca_cert) = match &self.cmd {
+        let (host_url, auth_token, ca_cert, tls_no_verify) = match &self.cmd {
             SubCommand::Trigger(TriggerConfig {
                 ca_cert,
+                tls_no_verify,
                 influxdb3_config:
                     InfluxDb3Config {
                         host_url,
                         auth_token,
                         ..
                     },
                 ..
-            }) => (host_url, auth_token, ca_cert),
+            }) => (host_url, auth_token, ca_cert, tls_no_verify),
         };
-        let mut client = Client::new(host_url.clone(), ca_cert.clone())?;
+        let mut client = Client::new(host_url.clone(), ca_cert.clone(), *tls_no_verify)?;
         if let Some(token) = &auth_token {
             client = client.with_auth_token(token.expose_secret());
         }
@@ -49,6 +50,10 @@ struct TriggerConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     pub ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    pub tls_no_verify: bool,
 }
 
 pub async fn command(config: Config) -> Result<(), Box<dyn Error>> {

influxdb3/src/commands/enable.rs

@@ -11,19 +11,20 @@ pub struct Config {
 
 impl Config {
     fn get_client(&self) -> Result<Client, Box<dyn Error>> {
-        let (host_url, auth_token, ca_cert) = match &self.cmd {
+        let (host_url, auth_token, ca_cert, tls_no_verify) = match &self.cmd {
             SubCommand::Trigger(TriggerConfig {
                 ca_cert,
+                tls_no_verify,
                 influxdb3_config:
                     InfluxDb3Config {
                         host_url,
                         auth_token,
                         ..
                     },
                 ..
-            }) => (host_url, auth_token, ca_cert),
+            }) => (host_url, auth_token, ca_cert, tls_no_verify),
         };
-        let mut client = Client::new(host_url.clone(), ca_cert.clone())?;
+        let mut client = Client::new(host_url.clone(), ca_cert.clone(), *tls_no_verify)?;
         if let Some(token) = &auth_token {
             client = client.with_auth_token(token.expose_secret());
         }
@@ -49,6 +50,10 @@ struct TriggerConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     pub ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    pub tls_no_verify: bool,
 }
 
 pub async fn command(config: Config) -> Result<(), Box<dyn Error>> {

influxdb3/src/commands/install.rs

@@ -55,11 +55,19 @@ pub struct PackageConfig {
     /// An optional arg to use a custom ca for useful for testing with self signed certs
     #[clap(long = "tls-ca", env = "INFLUXDB3_TLS_CA")]
     ca_cert: Option<PathBuf>,
+
+    /// Disable TLS certificate verification
+    #[clap(long = "tls-no-verify", env = "INFLUXDB3_TLS_NO_VERIFY")]
+    tls_no_verify: bool,
 }
 
 impl PackageConfig {
     async fn run_command(&self) -> Result<(), anyhow::Error> {
-        let mut client = Client::new(self.host_url.clone(), self.ca_cert.clone())?;
+        let mut client = Client::new(
+            self.host_url.clone(),
+            self.ca_cert.clone(),
+            self.tls_no_verify,
+        )?;
         if let Some(token) = &self.auth_token {
             client = client.with_auth_token(token.expose_secret());
         }