Re-verify attestation on TLS certificate rotation

[sachaservan]

Summary by cubic

Automatically re-verifies enclave attestation on TLS certificate rotation and retries the request once to reduce downtime.

• New Features

  • Added reverify() to force attestation refresh. For httpx clients, call it and then recreate the client via make_secure_http_client() or make_secure_async_http_client().
  • make_request now retries once after re-attestation only on certificate fingerprint mismatch. If re-verification fails, the original error is raised. Other errors propagate without re-attesting.

• Refactors

  • Extracted _send_request() for a single attempt using the current pinned client.

^{Written for commit b18034b. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/tinfoil/client.py">

<violation number="1" location="src/tinfoil/client.py:243">
P1: The retry logic unintentionally treats HTTP status errors as TLS/connection failures, so 4xx/5xx responses can trigger a full re-attestation and a second request (including duplicate POSTs).</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}