diff mbox series

[2/2] utils/genrandconfig: do not check certificates with curl

Message ID 8c1d3b15de6ac98e7dc9ad94db5bf56011b1bc66.1716063903.git.yann.morin.1998@free.fr
State Changes Requested
Headers show
Series support/download: fix running on hosts with wget2 (branch yem/dl-curl) | expand

Commit Message

Yann E. MORIN May 18, 2024, 8:25 p.m. UTC 
genrandconfig is used in autobuilders, and some autobuilders are running
on old distributions that are lacking the most recent CAs, causing build
failures because package sources can't be retrieved.

Do for the curl backend what we already did a while back for the wget
backend, with commit 0866a280e40a (utils/genrandconfig: use
--no-check-certificate in wget by default); in curl, the equivalent
would be --insecure, and applies to the ftps transport.

The integrity of the downloads are validated against our bundled hashes
so there is no risk of corruption of the downloaded files. The only
issue would be that an MITM could inspect the transaction, the same way
as for the wget --no-check-certificate in 0866a280e40a, but this is not
considered a high-level issue (we're anyway talking FTPS here, that's a
legacy protocol that has other issues).

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

---
Note: this is totally untested, because FTPS is not widespread and no
known package was available via FTPS. This patch can probably be dropped.
---
 utils/genrandconfig | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/utils/genrandconfig b/utils/genrandconfig
index df6bede158..63fbf617f4 100755
--- a/utils/genrandconfig
+++ b/utils/genrandconfig
@@ -699,6 +699,7 @@  def gen_config(args):
 
     # Allow hosts with old certificates to download over https
     configlines.append("BR2_WGET=\"wget --passive-ftp -nd -t 3 --no-check-certificate\"\n")
+    configlines.append("BR2_CURL=\"curl --ftp-pasv --retry 3 --insecure\"\n")
 
     # Per-package folder
     if randint(0, 15) == 0: