From ddc6ce020e127439c0a456844140321bb3567288 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Mon, 16 Mar 2026 17:57:26 +0100
Subject: [PATCH] Conditionally disable peer verification for ZIP streaming

---
 app/models/zip_file.rb           | 3 ++-
 app/models/zip_file/remote_io.rb | 8 ++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/app/models/zip_file.rb b/app/models/zip_file.rb
index dc5b7ee8d..3415f5879 100644
--- a/app/models/zip_file.rb
+++ b/app/models/zip_file.rb
@@ -84,7 +84,8 @@ class ZipFile
 
       def read_from_s3(blob)
         url = blob.url(expires_in: 6.hour)
-        remote_io = RemoteIO.new(url)
+        ssl_verify_peer = blob.service.client.client.config.ssl_verify_peer
+        remote_io = RemoteIO.new(url, ssl_verify_peer: ssl_verify_peer)
         reader = Reader.new(remote_io)
         yield reader
       end
diff --git a/app/models/zip_file/remote_io.rb b/app/models/zip_file/remote_io.rb
index 1cb00831a..59329d811 100644
--- a/app/models/zip_file/remote_io.rb
+++ b/app/models/zip_file/remote_io.rb
@@ -1,4 +1,9 @@
 class ZipFile::RemoteIO < ZipKit::RemoteIO
+  def initialize(url, ssl_verify_peer: true)
+    super(url)
+    @ssl_verify_peer = ssl_verify_peer
+  end
+
   protected
     def request_range(range)
       with_http do |http|
@@ -37,8 +42,7 @@ class ZipFile::RemoteIO < ZipKit::RemoteIO
     def with_http
       http = Net::HTTP.new(@uri.hostname, @uri.port)
       http.use_ssl = @uri.scheme == "https"
-      # FIXME: Disable SSL verification for now to avoid issues with our self-signed certificates for PureStorage
-      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      http.verify_mode = OpenSSL::SSL::VERIFY_NONE unless @ssl_verify_peer
       http.start { yield http }
     end
 end