[sodle-splunk]

Summary

• add opt-out TLS certificate verification enabled by default to generated connectors
• default the connector runtime to verification even when the manifest key is absent
• protect generated connector API keys as password configuration fields

Tracking

• PAPP-38137
• PSAAS-30958
• Related credential finding: PAPP-38134 / PSAAS-30906
• Parent epic: ESPM-5228
• Quality-gate blocker: fix: allow connector template placeholder identity phantomcyber/dev-cicd-tools#248

Validation

• python3 -m py_compile template_connector.py template_consts.py
• static tests pass with dev-cicd-tools PR 248 applied
• hosted pre-commit remains blocked until that central fix is merged and released

Created by Codex with AI assistance.

Tracking

• PAPP: PAPP-38137
• PSAAS: PSAAS-30958
• Written by Codex.

Merge strategy: merge commit only; do not squash.

Written by Codex.

Release impact

This PR contains a breaking configuration change and must ship as a major release. Connectors generated from this template now verify server certificates by default; generated assets must trust the server certificate chain or explicitly disable verification. The corresponding functional commit includes a parseable BREAKING CHANGE: trailer for semantic-release.

Release-impact note added by Codex.

[github-actions]

Merging this PR will release 2.0.0 with the following release notes:

2.0.0 (2026-08-05)

Connector release changes

• Added opt-out TLS certificate verification that defaults to enabled for generated connectors.
• Protected API keys as password configuration fields in generated connectors.

[sodle-splunk]

The remaining static-test failures are caused by the shared registry hook rejecting the connector template’s intentionally reserved placeholder identity. I opened phantomcyber/dev-cicd-tools#251 with an exact-match exemption and regression tests. This connector PR remains draft until that platform fix is merged, released, and its pre-commit gate passes.

— Codex

[sodle-splunk]

The build failure is caused by the template repository intentionally using a sentinel app ID even though the shared workflow attempts to package it as a publishable app. The platform-side fix is splunk-soar-connectors/.github#415; app ID validation remains strict for real apps. Written by Codex.

[sodle-splunk]

Codex breaking-change review: this PR needs to be redone as a breaking/major release before merge.

Reason: it adds optional verify_server_cert with default: true. Under the updated connector release guidance, changing secure transport/config defaults in a way that can make existing assets fail where they previously succeeded is a breaking change. If the secure default is intentional, please preserve it but add major-release treatment: a parseable BREAKING CHANGE: trailer (or equivalent breaking Conventional Commit), release notes that call out the behavior change and migration impact, and any required PR description updates. If this should remain a non-major release, preserve the previous runtime default instead and document the opt-in secure setting.

Commented by Codex.

[phantom-jacob]

Written by Codex for Jacob: template_connector.py sets _verify with config.get("verify_server_cert", True). A persisted JSON null returns None, which requests treats as falsey and can disable verification despite the documented secure default. Please use config.get("verify_server_cert") is not False so only an explicit boolean false opts generated connectors out.

[sodle-splunk]

Codex update: the requested secure-default handling is implemented at the current head by fix: require explicit TLS opt-out. All hosted checks are green.