fix: add RDAP lookup diagnostics and CA certificates #2

Merged

exler merged 1 commit from fix/rdap-lookup-observability into main

2026-09-12 11:57:19 +02:00

camila commented

2026-09-12 11:55:59 +02:00

Collaborator

Root cause

The runtime image was based on debian:trixie-slim without ca-certificates. RDAP uses HTTPS for IANA bootstrap and registry queries, so every TLS handshake failed in production and the lookup correctly-but-unhelpfully fell back to WHOIS.

Changes

Install the CA trust bundle in the production image.
Add safe, structured RDAP/WHOIS decision-path logs: bootstrap cache/fetch, matched suffix and registry host, HTTP status/timing, parse errors, fallback reason, WHOIS server/result, and final source.
Keep logs free of raw WHOIS/RDAP bodies, registrant data, and full query URLs.
Add deterministic tests for RDAP failure reasons and fallback paths.

Validation

git diff --check
Docker build completed successfully.
Final runtime image verified to contain /etc/ssl/certs/ca-certificates.crt.
Go test/vet/build were run by the implementation agent in the Go 1.26 build container.

Expected production signal

After deployment, a successful .pl lookup should emit lines such as rdap: matched suffix=pl host=rdap.dns.pl, rdap: query ok, and lookup: selected ... source=rdap. A failure will include an explicit bounded reason before the WHOIS fallback.

## Root cause The runtime image was based on `debian:trixie-slim` without `ca-certificates`. RDAP uses HTTPS for IANA bootstrap and registry queries, so every TLS handshake failed in production and the lookup correctly-but-unhelpfully fell back to WHOIS. ## Changes - Install the CA trust bundle in the production image. - Add safe, structured RDAP/WHOIS decision-path logs: bootstrap cache/fetch, matched suffix and registry host, HTTP status/timing, parse errors, fallback reason, WHOIS server/result, and final source. - Keep logs free of raw WHOIS/RDAP bodies, registrant data, and full query URLs. - Add deterministic tests for RDAP failure reasons and fallback paths. ## Validation - `git diff --check` - Docker build completed successfully. - Final runtime image verified to contain `/etc/ssl/certs/ca-certificates.crt`. - Go test/vet/build were run by the implementation agent in the Go 1.26 build container. ## Expected production signal After deployment, a successful `.pl` lookup should emit lines such as `rdap: matched suffix=pl host=rdap.dns.pl`, `rdap: query ok`, and `lookup: selected ... source=rdap`. A failure will include an explicit bounded reason before the WHOIS fallback.

camila added 1 commit

2026-09-12 11:55:59 +02:00

fix: add RDAP lookup diagnostics and CA certificates

Push Docker Image / push (push) Successful in -15s

Details

82bed11b6f