功能：扩展云管资源运维、账号授权及监控管理

platform/pkg/proxmox/client.go

@@ -51,18 +51,28 @@ func New(base, id, secret, caFile string) (*Client, error) {
 	if u.Path != "" && u.Path != "/" {
 		return nil, errors.New("PVE_URL must not include a path")
 	}
-	pool, err := x509.SystemCertPool()
-	if err != nil {
-		pool = x509.NewCertPool()
-	}
+	pem := ""
 	if caFile != "" {
 		data, err := os.ReadFile(caFile)
 		if err != nil {
 			return nil, err
 		}
-		if !pool.AppendCertsFromPEM(data) {
-			return nil, errors.New("invalid PVE CA file")
-		}
+		pem = string(data)
+	}
+	return NewWithCA(base, id, secret, pem)
+}
+
+func NewWithCA(base, id, secret, pem string) (*Client, error) {
+	u, err := url.Parse(base)
+	if err != nil || u.Scheme != "https" || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || (u.Path != "" && u.Path != "/") {
+		return nil, errors.New("invalid HTTPS origin")
+	}
+	pool, err := x509.SystemCertPool()
+	if err != nil {
+		pool = x509.NewCertPool()
+	}
+	if pem != "" && !pool.AppendCertsFromPEM([]byte(pem)) {
+		return nil, errors.New("invalid CA certificate")
 	}
 	return &Client{BaseURL: strings.TrimRight(base, "/"), TokenID: id, TokenSecret: secret, HTTP: &http.Client{Timeout: 15 * time.Second, CheckRedirect: func(_ *http.Request, _ []*http.Request) error { return http.ErrUseLastResponse }, Transport: &http.Transport{TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS12, RootCAs: pool}}}}, nil
 }