From 5f5e4efe1a07ca0bf0bc5e21eb1ac31b21b40c82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Reis?= <joao.reis@ibm.com>
Date: Wed, 2 Sep 2026 14:41:31 +0100
Subject: [PATCH 1/3] Do not use system cert pool when connecting to Astra

---
 astra/bundle.go        | 15 ++++-----------
 astra/endpoint_test.go |  5 +----
 proxy/run_test.go      |  4 ++--
 3 files changed, 7 insertions(+), 17 deletions(-)

diff --git a/astra/bundle.go b/astra/bundle.go
index ff04565..2d6f59a 100644
--- a/astra/bundle.go
+++ b/astra/bundle.go
@@ -26,7 +26,6 @@ import (
 	"io"
 	"io/ioutil"
 	"net/http"
-	"runtime"
 	"time"
 
 	"github.com/datastax/astra-client-go/v2/astra"
@@ -53,10 +52,7 @@ func LoadBundleZip(reader *zip.Reader) (*Bundle, error) {
 		return nil, err
 	}
 
-	rootCAs, err := createCertPool()
-	if err != nil {
-		return nil, err
-	}
+	rootCAs := createCertPool()
 
 	ok := rootCAs.AppendCertsFromPEM(contents["ca.crt"])
 	if !ok {
@@ -200,10 +196,7 @@ func loadBytes(file *zip.File) ([]byte, error) {
 	return ioutil.ReadAll(r)
 }
 
-func createCertPool() (*x509.CertPool, error) {
-	ca, err := x509.SystemCertPool()
-	if err != nil && runtime.GOOS == "windows" {
-		return x509.NewCertPool(), nil
-	}
-	return ca, err
+
+func createCertPool() *x509.CertPool {
+	return x509.NewCertPool()
 }
diff --git a/astra/endpoint_test.go b/astra/endpoint_test.go
index 649c783..e73cf64 100644
--- a/astra/endpoint_test.go
+++ b/astra/endpoint_test.go
@@ -233,10 +233,7 @@ func runTestMetaSvcAsync(sniProxyAddr string, contactPoints []string) (*http.Ser
 }
 
 func createServerTLSConfig(dnsName string) (*tls.Config, error) {
-	rootCAs, err := createCertPool()
-	if err != nil {
-		return nil, err
-	}
+	rootCAs := createCertPool()
 
 	if !rootCAs.AppendCertsFromPEM(testCAPEM) {
 		return nil, errors.New("unable to add cert to CA pool")
diff --git a/proxy/run_test.go b/proxy/run_test.go
index 2e4f698..51cd34f 100644
--- a/proxy/run_test.go
+++ b/proxy/run_test.go
@@ -461,7 +461,7 @@ func TestRun_ProxyTLS(t *testing.T) {
 		return checkLiveness(httpBindAddr)
 	}))
 
-	rootCAs, err := createCertPool()
+	rootCAs, err := createSystemCertPool()
 	require.NoError(t, err)
 
 	ok := rootCAs.AppendCertsFromPEM(testCAPEM)
@@ -720,7 +720,7 @@ func checkReadiness(t *testing.T, host string) (outage time.Duration, status int
 	return outage, res.StatusCode
 }
 
-func createCertPool() (*x509.CertPool, error) {
+func createSystemCertPool() (*x509.CertPool, error) {
 	ca, err := x509.SystemCertPool()
 	if err != nil && runtime.GOOS == "windows" {
 		return x509.NewCertPool(), nil

From fdb7c98758a7700b2b533b4ec3b10a3f234bd7b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Reis?= <joao.reis@ibm.com>
Date: Wed, 2 Sep 2026 15:01:40 +0100
Subject: [PATCH 2/3] Set minimum Go version required to compile to 1.19

---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 4d4784c..e499b1c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/datastax/cql-proxy
 
-go 1.24.2
+go 1.19
 
 require (
 	github.com/alecthomas/kong v0.2.17

From b74e5c15f712f94b98875ffc17ecca8828a15526 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Reis?= <joao.reis@ibm.com>
Date: Wed, 2 Sep 2026 16:47:01 +0100
Subject: [PATCH 3/3] remove codeowners file

---
 .github/CODEOWNERS | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 .github/CODEOWNERS

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
deleted file mode 100644
index e11c717..0000000
--- a/.github/CODEOWNERS
+++ /dev/null
@@ -1 +0,0 @@
-* @mpenick @dougwettlaufer