[j-nowak]

Fixes DEVSVCS-6732

Problem

When seth is given an RPC URL (WithRpcUrl), it dials through NewLoggingTransport(). That transport always sets TLSClientConfig: &tls.Config{InsecureSkipVerify: true}. As a result, every command that talks to the Workflow Registry onchain skipped certificate checks: workflow deploy/activate/pause/delete, account link-key/unlink-key and secrets *. Someone who can intercept the traffic could return false contract state or inflated gas prices, or read RPC API keys that are part of the URL.

Change

In NewSethClientWithSimulated, the RPC connection is now dialed with rpc.DialOptions and go-ethereum's default transport, which verifies certificates. It is passed to seth with WithEthClient. RPCHeaders from a seth config file are still sent.

Seth only sets up two things when it dials the URL itself, so restoreRPCURL puts them back after Build():

• client.URL, which is used in debug logging.
• The revert tracer. The default tracing level is reverted. Without a tracer, Decode would hit a nil pointer on any reverted transaction. seth.NewTracer dials with the default transport, so it verifies certificates too.

Other details:

• In the config-file path, the selected network's URLs are cleared before building, because seth refuses configs that set both URLs and an ethclient.
• If there is no RPC URL and no simulated backend, the function now returns an error instead of crashing.

Tests

cmd/client/eth_client_tls_test.go:

• Untrusted certificate: an httptest.NewTLSServer with a self-signed certificate must cause a certificate error, and no request may reach the handler. I ran this test against the old code and it failed: the old code connected without complaint.
• Trusted certificate: with the test server's certificate trusted, RPC calls succeed and URL and Tracer are set.

go test ./cmd/client/... ./cmd/workflow/... ./cmd/secrets/... ./cmd/account/... passes. I couldn't run golangci-lint locally, because none of the installed versions supports Go 1.27.3.

🤖 Generated with Claude Code