What if GitHub is down?

[garethellis36]

Hello,

If I understand the source code correctly, if GitHub is down or there is some kind of network availability issue, RemoteFetch::remoteFetchBundles() is going to throw a TransferException from Guzzle. Do I have this right? In other words, to properly use this class, we should wrap calls to getLatestBundle() in try/catch and fall back to the Fetch class?

[paragonie-scott]

Alternatively, assuming you have a mirror somewhere else:

<?php
use ParagonIE\Certainty\RemoteFetch;
use GuzzleHttp\Exception\TransferException;

try {
    $fetch = new RemoteFetch('/path/to/certainty/data');
    $latestCACertBundle = $fetch->getLatestBundle();
} catch (TransferException $ex) {
    $fetch = new RemoteFetch(
        '/path/to/certainty/data',
        'https://example.com/certainty/data'
    );
    $latestCACertBundle = $fetch->getLatestBundle();
}

[paragonie-scott]

Ultimately, falling back to the Fetch class as a last ditch effort if both Github and whatever backup you use are down is a good idea, but if you're having a network availability error, the ensuing HTTPS request will also fail.