feature/srtsp-support - #316
Merged
Merged
Conversation
- Updated README.md to include instructions for using RTSPS camera URLs. - Enhanced gortsplib.go to support insecure TLS configuration for self-signed certificates. - Added unit tests for RTSPS TLS configuration in gortsplib_test.go.
…es in README-RTSPS-TLS.md
Contributor
There was a problem hiding this comment.
Pull request overview
Adds first-class documentation and an opt-in runtime escape hatch for connecting to IP cameras over RTSPS (RTSP over TLS), including guidance for private-CA trust distribution and Bosch-specific certificate behavior.
Changes:
- Documented RTSPS usage and configuration in
README.md, including a newAGENT_CAPTURE_IPCAMERA_RTSPS_INSECUREtoggle. - Added a comprehensive RTSPS/TLS troubleshooting and deployment guide (
README-RTSPS-TLS.md). - Wired an optional
tls.Configinto gortsplib clients (only when explicitly enabled via env var) and added unit tests for the toggle behavior.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| README.md | Adds RTSPS configuration section and documents the new insecure toggle. |
| README-RTSPS-TLS.md | New detailed guide covering cert identity, private CA issuance, validation, and troubleshooting. |
| machinery/src/capture/gortsplib.go | Adds TLSConfig plumbing for gortsplib with an explicit env-controlled insecure mode. |
| machinery/src/capture/gortsplib_test.go | Adds unit tests to validate default secure behavior and explicit insecure opt-in. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Motivation
We need secure camera streaming support in Kerberos Agent that works in real deployments where IP cameras use TLS certificates (often issued by private CAs) and where correct server identity verification (SAN/IP match) is critical. Until now, the project documentation and implementation didn’t clearly cover RTSPS/TLS certificate handling, trust-bundle composition, and the safe way to validate end-to-end trust.
What changed / why it improves the project
RTSPS/TLS configuration is now supported and wired into the RTSP client
rtsps://camera URLs now pass an explicit TLS configuration to gortsplib.A controlled insecure escape hatch is provided
AGENT_CAPTURE_IPCAMERA_RTSPS_INSECURE=trueto opt intoInsecureSkipVerifyonly when a trusted CA bundle can’t be installed.Project documentation explains the full certificate and trust flow
README-RTSPS-TLS.mdwith a step-by-step guide for Bosch RTSPS/TLS, including:README.mdwith concise RTSPS usage, new env var, and references.Test coverage for the TLS verification switch
TestRTSPSTLSConfigto ensure verification is on by default and correctly disabled only when explicitly requested.Overall, this PR makes RTSPS support safer and more operational: users can deploy with proper private-CA trust bundles, get predictable identity verification behavior, and have clear validation guidance when troubleshooting camera TLS issues.