Re: [Buildroot] [PATCH 2/2 v2] utils/genrandconfig: do not check certificates with curl

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

On Sun,  2 Jun 2024 20:23:08 +0200
"Yann E. MORIN" <yann.morin.1998@free.fr> wrote:

> genrandconfig is used in autobuilders, and some autobuilders are running
> on old distributions that are lacking the most recent CAs, causing build
> failures because package sources can't be retrieved.
> 
> Do for the curl backend what we already did a while back for the wget
> backend, with commit 0866a280e40a (utils/genrandconfig: use
> --no-check-certificate in wget by default); in curl, the equivalent
> would be --insecure, and applies to the ftps transport.
> 
> The integrity of the downloads are validated against our bundled hashes
> so there is no risk of corruption of the downloaded files. The only
> issue would be that an MITM could inspect the transaction, the same way
> as for the wget --no-check-certificate in 0866a280e40a, but this is not
> considered a high-level issue (we're anyway talking FTPS here, that's a
> legacy protocol that has other issues).
> 
> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
> 
> ---
> Note: this is totally untested, because FTPS is not widespread and no
> known package was available via FTPS. This patch can probably be dropped.
> ---
>  utils/genrandconfig | 1 +
>  1 file changed, 1 insertion(+)

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot