XO0902: `tls.Verify.None` checks no certificate

Reported by xo vet as a warning, once per use. A tls.client with verify: tls.Verify.None encrypts the connection but accepts any certificate, so an active attacker can stand in for the server (libpq’s sslmode=require). tls.Verify.ChainOnly checks the chain against the roots without the host name (sslmode=verify-ca), and roots: tls.roots(pem) trusts a private CA while keeping the full check.

Example

tls.client(c, host, verify: tls.Verify.None)

Fix

tls.client(c, host, roots: Some(tls.roots(ca_pem)?))

Run xo explain XO0902 for this text in a terminal, or see section 10.6 of the specification.