Merge pull request #2710 from basecamp/conditionally_disable_peer_verification_for_zip_streaming

Conditionally disable peer verification for ZIP streaming

app/models/zip_file.rb

@@ -84,7 +84,8 @@ class ZipFile
 
       def read_from_s3(blob)
         url = blob.url(expires_in: 6.hour)
-        remote_io = RemoteIO.new(url)
+        ssl_verify_peer = blob.service.client.client.config.ssl_verify_peer
+        remote_io = RemoteIO.new(url, ssl_verify_peer: ssl_verify_peer)
         reader = Reader.new(remote_io)
         yield reader
       end

app/models/zip_file/remote_io.rb

@@ -1,4 +1,9 @@
 class ZipFile::RemoteIO < ZipKit::RemoteIO
+  def initialize(url, ssl_verify_peer: true)
+    super(url)
+    @ssl_verify_peer = ssl_verify_peer
+  end
+
   protected
     def request_range(range)
       with_http do |http|
@@ -37,8 +42,7 @@ class ZipFile::RemoteIO < ZipKit::RemoteIO
     def with_http
       http = Net::HTTP.new(@uri.hostname, @uri.port)
       http.use_ssl = @uri.scheme == "https"
-      # FIXME: Disable SSL verification for now to avoid issues with our self-signed certificates for PureStorage
-      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      http.verify_mode = OpenSSL::SSL::VERIFY_NONE unless @ssl_verify_peer
       http.start { yield http }
     end
 end