bosh-nats-sync: use code.cloudfoundry.org/tlsconfig instead of hand-rolled tls.Config

Address item 1 in PR review comment
#2746 (comment):
authprovider and userssync both built their director/UAA TLS client by hand
(manual tls.Config{MinVersion}, x509.NewCertPool(), AppendCertsFromPEM). CF
already ships code.cloudfoundry.org/tlsconfig as the standard helper for
exactly this, and the reviewer noted the hand-rolled config was actually
*less* hardened than the org-standard one (no MaxVersion, no cipher-suite
pinning).

Deliberately does NOT touch items 2/3 from the same comment (reusing
bosh-cli's director/uaa packages for the director API and UAA calls) per
explicit instruction to avoid a github.com/cloudfoundry/bosh-cli dependency;
that remains a footprint-vs-reuse tradeoff for a future PR, not something to
pull in incidentally here.

pkg/authprovider/auth_provider.go:
- buildHTTPClient now builds its *tls.Config via
  tlsconfig.Build(tlsconfig.WithExternalServiceDefaults()).Client(...),
  applying tlsconfig.WithAuthorityFromFile(caCertPath) only when CAFilePath()
  resolves to a file with non-empty content. WithExternalServiceDefaults()
  pins MinVersion/MaxVersion to TLS 1.2-1.3 and a curated Mozilla-Intermediate
  cipher-suite list, in place of the previous MinVersion-only config.
- Preserves existing behavior exactly: a configured-but-unreadable CA file is
  still a hard error, an empty file still falls back to the system trust
  store, and a malformed (but present/non-empty) cert is still a hard error.

pkg/userssync/users_sync.go:
- buildHTTPClient now uses the same tlsconfig.Build(...).Client(...) pattern
  for the director API client. Replaced directorCACertPool (manual
  x509.CertPool + AppendCertsFromPEM) with a small usableCACertContent(path)
  predicate that gates whether tlsconfig.WithAuthorityFromFile is applied.
- Preserves existing behavior: director_ca_cert missing/unreadable/empty
  falls back to the system trust store (no error, matching Ruby's
  usable_director_ca_cert?), while a configured-but-unparseable cert is a
  hard error rather than a silent fallback.

pkg/userssync/export_test.go:
- Replaced the removed DirectorCACertPool test hook with
  BuildDirectorTLSConfig, which builds the real *http.Client via
  buildHTTPClient and returns its *tls.Config, so tests assert against the
  actual TLS configuration (RootCAs, MinVersion) rather than an internal
  CertPool-returning helper that no longer exists.

pkg/userssync/users_sync_test.go:
- Rewrote the "directorCACertPool" spec block against BuildDirectorTLSConfig:
  same four cases (not configured / missing file / whitespace-only file /
  unparseable content) now assert on tlsCfg.RootCAs and the error message,
  plus a new case asserting MinVersion is pinned to TLS 1.2 via
  WithExternalServiceDefaults.

Dependency footprint: go.mod/go.sum/vendor pick up
code.cloudfoundry.org/tlsconfig v0.61.0 and a matching golang.org/x/sys
patch bump (v0.44.0 -> v0.46.0, already an existing indirect dependency).
tlsconfig's own test-only dependencies (certstrap, go.step.sm/crypto,
golang.org/x/crypto, etc.) appear in go.sum for module-graph completeness
but are not imported by any non-test file, so `go mod vendor` does not pull
them into vendor/ or the build.

Verified `go build`, `go vet`, and `go test -race ./...` all pass with both
the default module resolution and explicit `-mod=vendor` (matching how
packages/nats/packaging invokes go build); gofmt and golangci-lint are clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: aramprice

src/bosh-nats-sync/go.mod

@@ -3,6 +3,7 @@ module bosh-nats-sync
 go 1.26.3
 
 require (
+	code.cloudfoundry.org/tlsconfig v0.61.0
 	github.com/onsi/ginkgo/v2 v2.28.1
 	github.com/onsi/gomega v1.39.1
 	golang.org/x/oauth2 v0.36.0
@@ -19,7 +20,7 @@ require (
 	golang.org/x/mod v0.34.0 // indirect
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/tools v0.43.0 // indirect
 )

src/bosh-nats-sync/go.sum

@@ -1,3 +1,7 @@
+code.cloudfoundry.org/tlsconfig v0.61.0 h1:3qP/E7g9ZiYnl1oypzL4BlzM9hLIIOewz/jr2LdtQeQ=
+code.cloudfoundry.org/tlsconfig v0.61.0/go.mod h1:teqTAz1XYQdNhDEc67uy3Zu1h5ujiPqnXE1v9tffTnE=
+filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
+filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -32,10 +36,14 @@ github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI
 github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
 github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
 github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/square/certstrap v1.3.0 h1:N9P0ZRA+DjT8pq5fGDj0z3FjafRKnBDypP0QHpMlaAk=
+github.com/square/certstrap v1.3.0/go.mod h1:wGZo9eE1B7WX2GKBn0htJ+B3OuRl2UsdCFySNooy9hU=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
@@ -46,8 +54,12 @@ github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
 github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
+go.step.sm/crypto v0.84.1 h1:i0JNkcLT7LcXef00TNpckjoTTH0QP6REHcAvnY3qrNY=
+go.step.sm/crypto v0.84.1/go.mod h1:T54MIdw42uZnz3+mjOIOpJbsbTZF+O3IOLhvU9lBoJk=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
 golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
 golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
@@ -56,8 +68,8 @@ golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
 golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=

src/bosh-nats-sync/pkg/authprovider/auth_provider.go

@@ -2,8 +2,6 @@ package authprovider
 
 import (
 	"context"
-	"crypto/tls"
-	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -16,6 +14,7 @@ import (
 
 	"bosh-nats-sync/pkg/config"
 
+	"code.cloudfoundry.org/tlsconfig"
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/clientcredentials"
 )
@@ -97,24 +96,32 @@ func (a *AuthProvider) uaaTokenHeader(ctx context.Context, uaaURL string) (strin
 	return formatBearer(tok), nil
 }
 
+// buildHTTPClient uses code.cloudfoundry.org/tlsconfig to build the TLS
+// configuration for UAA token requests. WithExternalServiceDefaults() pins
+// MinVersion/MaxVersion (TLS 1.2-1.3) and a curated cipher-suite list, matching
+// CF's standard for talking to services we don't control on the other end.
+// director_ca_cert / uaa_ca_cert (via CAFilePath) is used as the trust root
+// when the file exists and has non-empty content; otherwise the system trust
+// store is used, matching the Ruby AuthProvider behaviour.
 func (a *AuthProvider) buildHTTPClient() (*http.Client, error) {
-	tlsCfg := &tls.Config{MinVersion: tls.VersionTLS12}
-
 	caCertPath := a.CAFilePath()
+
+	var clientOpts []tlsconfig.ClientOption
 	if caCertPath != "" {
 		data, err := os.ReadFile(caCertPath)
 		if err != nil {
 			return nil, fmt.Errorf("failed to read CA cert file %q: %w", caCertPath, err)
 		}
 		if len(strings.TrimSpace(string(data))) > 0 {
-			pool := x509.NewCertPool()
-			if !pool.AppendCertsFromPEM(data) {
-				return nil, fmt.Errorf("failed to parse CA certificate from %q", caCertPath)
-			}
-			tlsCfg.RootCAs = pool
+			clientOpts = append(clientOpts, tlsconfig.WithAuthorityFromFile(caCertPath))
 		}
 	}
 
+	tlsCfg, err := tlsconfig.Build(tlsconfig.WithExternalServiceDefaults()).Client(clientOpts...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to build TLS config for CA cert %q: %w", caCertPath, err)
+	}
+
 	return &http.Client{
 		Timeout:   httpClientTimeout,
 		Transport: &http.Transport{TLSClientConfig: tlsCfg},

src/bosh-nats-sync/pkg/userssync/export_test.go

@@ -1,14 +1,22 @@
 package userssync
 
-import "crypto/x509"
+import (
+	"crypto/tls"
+	"net/http"
+)
 
 // IsConnectionError exposes isConnectionError for use in external test packages.
 // This file is compiled only during test runs.
 var IsConnectionError = isConnectionError
 
-// DirectorCACertPool exposes directorCACertPool so external tests can assert the
-// "use system trust store" (nil pool, nil error) vs "fail loudly" (error)
-// behavior for a configured director_ca_cert.
-func (u *UsersSync) DirectorCACertPool() (*x509.CertPool, error) {
-	return u.directorCACertPool()
+// BuildDirectorTLSConfig exposes the *tls.Config built from director_ca_cert so
+// external tests can assert the "use system trust store" (RootCAs nil, no
+// error) vs "fail loudly" (error) behavior without reaching into the internals
+// of buildHTTPClient.
+func (u *UsersSync) BuildDirectorTLSConfig() (*tls.Config, error) {
+	client, err := u.buildHTTPClient()
+	if err != nil {
+		return nil, err
+	}
+	return client.Transport.(*http.Transport).TLSClientConfig, nil
 }

src/bosh-nats-sync/pkg/userssync/users_sync.go

@@ -4,8 +4,6 @@ import (
 	"bytes"
 	"context"
 	"crypto/sha256"
-	"crypto/tls"
-	"crypto/x509"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -24,6 +22,8 @@ import (
 	"bosh-nats-sync/pkg/authprovider"
 	"bosh-nats-sync/pkg/config"
 	"bosh-nats-sync/pkg/natsauthconfig"
+
+	"code.cloudfoundry.org/tlsconfig"
 )
 
 const (
@@ -394,45 +394,43 @@ func (u *UsersSync) httpClient() (*http.Client, error) {
 	return u.client, u.clientErr
 }
 
-// buildHTTPClient mirrors the Ruby NATSSync::UsersSync HTTP client: TLS peer
-// verification is always on, and director_ca_cert is used as the trust root
-// when the file exists and has non-empty content; otherwise the system trust
-// store is used. A configured-but-unparseable cert is a hard error rather than
-// a silent fallback to the system store.
+// buildHTTPClient uses code.cloudfoundry.org/tlsconfig to build the TLS
+// configuration for director API requests. WithExternalServiceDefaults() pins
+// MinVersion/MaxVersion (TLS 1.2-1.3) and a curated cipher-suite list, matching
+// CF's standard for talking to services we don't control on the other end.
+// director_ca_cert is used as the trust root when the file exists and has
+// non-empty content; otherwise the system trust store is used, matching the
+// Ruby NATSSync::UsersSync behaviour. A configured-but-unparseable cert is a
+// hard error rather than a silent fallback to the system store.
 func (u *UsersSync) buildHTTPClient() (*http.Client, error) {
-	tlsCfg := &tls.Config{MinVersion: tls.VersionTLS12}
-	pool, err := u.directorCACertPool()
-	if err != nil {
-		return nil, err
+	certPath := u.boshConfig.DirectorCACert
+
+	var clientOpts []tlsconfig.ClientOption
+	if usableCACertContent(certPath) {
+		clientOpts = append(clientOpts, tlsconfig.WithAuthorityFromFile(certPath))
 	}
-	if pool != nil {
-		tlsCfg.RootCAs = pool
+
+	tlsCfg, err := tlsconfig.Build(tlsconfig.WithExternalServiceDefaults()).Client(clientOpts...)
+	if err != nil {
+		return nil, fmt.Errorf("director_ca_cert %q: %w", certPath, err)
 	}
+
 	return &http.Client{
 		Transport: &http.Transport{TLSClientConfig: tlsCfg},
 		Timeout:   httpClientTimeout,
 	}, nil
 }
 
-// directorCACertPool returns the CA pool built from director_ca_cert, or nil to
-// signal "use the system trust store". It returns nil (system store) when the
-// cert is not configured, missing/unreadable, or empty — matching the Ruby
-// usable_director_ca_cert? predicate — but returns an error when a configured
-// file contains no parseable certificate.
-func (u *UsersSync) directorCACertPool() (*x509.CertPool, error) {
-	certPath := u.boshConfig.DirectorCACert
-	if certPath == "" {
-		return nil, nil
-	}
-	data, err := os.ReadFile(certPath)
-	if err != nil || len(strings.TrimSpace(string(data))) == 0 {
-		return nil, nil
-	}
-	pool := x509.NewCertPool()
-	if !pool.AppendCertsFromPEM(data) {
-		return nil, fmt.Errorf("director_ca_cert %q contains no valid certificates", certPath)
+// usableCACertContent reports whether path points to a readable, non-empty CA
+// certificate file. Matches the Ruby usable_director_ca_cert? predicate: a
+// missing, unreadable, or empty file falls back to the system trust store
+// rather than being treated as configured.
+func usableCACertContent(path string) bool {
+	if path == "" {
+		return false
 	}
-	return pool, nil
+	data, err := os.ReadFile(path)
+	return err == nil && len(strings.TrimSpace(string(data))) > 0
 }
 
 type deployment struct {

src/bosh-nats-sync/pkg/userssync/users_sync_test.go

@@ -3,6 +3,7 @@ package userssync_test
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"encoding/pem"
 	"errors"
@@ -866,9 +867,10 @@ var _ = Describe("UsersSync", func() {
 
 	// REVIEW S1: a configured-but-unparseable director_ca_cert must be a hard
 	// error, not a silent fallback to the system trust store. Missing/empty
-	// certs fall back to the system store (nil pool, nil error), matching Ruby's
-	// usable_director_ca_cert? predicate.
-	Describe("directorCACertPool", func() {
+	// certs fall back to the system store (RootCAs nil, no error), matching
+	// Ruby's usable_director_ca_cert? predicate. TLS config is built via
+	// code.cloudfoundry.org/tlsconfig (see PR review comment #1).
+	Describe("buildHTTPClient TLS config (director_ca_cert)", func() {
 		var tmpDir string
 
 		BeforeEach(func() {
@@ -878,37 +880,44 @@ var _ = Describe("UsersSync", func() {
 		})
 		AfterEach(func() { os.RemoveAll(tmpDir) })
 
-		It("returns the system store (nil, nil) when not configured", func() {
+		It("uses the system trust store (RootCAs nil) when not configured", func() {
 			boshConfig = config.DirectorConfig{DirectorCACert: ""}
-			pool, err := createSync().DirectorCACertPool()
+			tlsCfg, err := createSync().BuildDirectorTLSConfig()
 			Expect(err).NotTo(HaveOccurred())
-			Expect(pool).To(BeNil())
+			Expect(tlsCfg.RootCAs).To(BeNil())
 		})
 
-		It("returns the system store (nil, nil) when the file is missing", func() {
+		It("uses the system trust store (RootCAs nil) when the file is missing", func() {
 			boshConfig = config.DirectorConfig{DirectorCACert: filepath.Join(tmpDir, "does-not-exist.pem")}
-			pool, err := createSync().DirectorCACertPool()
+			tlsCfg, err := createSync().BuildDirectorTLSConfig()
 			Expect(err).NotTo(HaveOccurred())
-			Expect(pool).To(BeNil())
+			Expect(tlsCfg.RootCAs).To(BeNil())
 		})
 
-		It("returns the system store (nil, nil) when the file is whitespace-only", func() {
+		It("uses the system trust store (RootCAs nil) when the file is whitespace-only", func() {
 			p := filepath.Join(tmpDir, "empty.pem")
 			Expect(os.WriteFile(p, []byte("  \n"), 0o600)).To(Succeed())
 			boshConfig = config.DirectorConfig{DirectorCACert: p}
-			pool, err := createSync().DirectorCACertPool()
+			tlsCfg, err := createSync().BuildDirectorTLSConfig()
 			Expect(err).NotTo(HaveOccurred())
-			Expect(pool).To(BeNil())
+			Expect(tlsCfg.RootCAs).To(BeNil())
 		})
 
 		It("fails loudly when the configured cert contains no valid certificate", func() {
 			p := filepath.Join(tmpDir, "garbage.pem")
 			Expect(os.WriteFile(p, []byte("not a pem certificate at all"), 0o600)).To(Succeed())
 			boshConfig = config.DirectorConfig{DirectorCACert: p}
-			_, err := createSync().DirectorCACertPool()
+			_, err := createSync().BuildDirectorTLSConfig()
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(ContainSubstring("no valid certificates"))
 		})
+
+		It("pins TLS 1.2 as the minimum version via tlsconfig.WithExternalServiceDefaults", func() {
+			boshConfig = config.DirectorConfig{DirectorCACert: ""}
+			tlsCfg, err := createSync().BuildDirectorTLSConfig()
+			Expect(err).NotTo(HaveOccurred())
+			Expect(tlsCfg.MinVersion).To(Equal(uint16(tls.VersionTLS12)))
+		})
 	})
 
 	Describe("ReloadNATSServerConfig", func() {