bundled cacert.pem with --ssl-ca-file PATH option (#480)

* Add a bundled cacert.pem from curl's website
* Using the --ssl-ca-file PATH option overrides ENV var SSL_CA_PATH
* Having none of those allow you to use the default, the bundled cacert.pem
* Octokit's SSL config uses this new setting
* Rake task to update_ssl_ca_file
* Rubocop target 2.2

lib/github_changelog_generator/octo_fetcher.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require "tmpdir"
 require "retriable"
 module GitHubChangelogGenerator
@@ -42,9 +43,16 @@ module GitHubChangelogGenerator
       @github_options[:access_token] = @github_token unless @github_token.nil?
       @github_options[:api_endpoint] = @options[:github_endpoint] unless @options[:github_endpoint].nil?
 
+      configure_octokit_ssl
+
       @client = Octokit::Client.new(@github_options)
     end
 
+    def configure_octokit_ssl
+      ca_file = @options[:ssl_ca_file] || ENV["SSL_CA_FILE"] || File.expand_path("../ssl_certs/cacert.pem", __FILE__)
+      Octokit.connection_options = { ssl: { ca_file: ca_file } }
+    end
+
     def init_cache
       middleware_opts = {
         serializer: Marshal,

lib/github_changelog_generator/options.rb

@@ -43,6 +43,7 @@ module GitHubChangelogGenerator
       :release_url,
       :simple_list,
       :since_tag,
+      :ssl_ca_file,
       :token,
       :unreleased,
       :unreleased_label,

lib/github_changelog_generator/parser.rb

@@ -1,5 +1,6 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
+
 require "optparse"
 require "pp"
 require_relative "version"
@@ -176,6 +177,9 @@ module GitHubChangelogGenerator
         opts.on("--cache-log [CACHE-LOG]", "Filename to use for cache log. Default is github-changelog-logger.log in a temporary directory.") do |cache_log|
           options[:cache_log] = cache_log
         end
+        opts.on("--ssl-ca-file [PATH]", "Path to cacert.pem file. Default is a bundled lib/github_changelog_generator/ssl_certs/cacert.pem. Respects SSL_CA_PATH.") do |ssl_ca_file|
+          options[:ssl_ca_file] = ssl_ca_file
+        end
         opts.on("--[no-]verbose", "Run verbosely. Default is true") do |v|
           options[:verbose] = v
         end
@@ -206,12 +210,13 @@ module GitHubChangelogGenerator
         unreleased: true,
         unreleased_label: "Unreleased",
         compare_link: true,
-        enhancement_labels: %w(enhancement Enhancement),
-        bug_labels: %w(bug Bug),
-        exclude_labels: %w(duplicate question invalid wontfix Duplicate Question Invalid Wontfix),
+        enhancement_labels: %w[enhancement Enhancement],
+        bug_labels: %w[bug Bug],
+        exclude_labels: %w[duplicate question invalid wontfix Duplicate Question Invalid Wontfix],
         issue_line_labels: [],
         max_issues: nil,
         simple_list: false,
+        ssl_ca_file: nil,
         verbose: true,
         header: "# Change Log",
         merge_prefix: "**Merged pull requests:**",