From a316aeb7dabec9febd664422fd97a431717b59b8 Mon Sep 17 00:00:00 2001 From: "Yann E. MORIN" Date: Sun, 2 Jun 2024 20:23:08 +0200 Subject: [PATCH] utils/genrandconfig: do not check certificates with curl genrandconfig is used in autobuilders, and some autobuilders are running on old distributions that are lacking the most recent CAs, causing build failures because package sources can't be retrieved. Do for the curl backend what we already did a while back for the wget backend, with commit 0866a280e40a (utils/genrandconfig: use --no-check-certificate in wget by default); in curl, the equivalent would be --insecure, and applies to the ftps transport. The integrity of the downloads are validated against our bundled hashes so there is no risk of corruption of the downloaded files. The only issue would be that an MITM could inspect the transaction, the same way as for the wget --no-check-certificate in 0866a280e40a, but this is not considered a high-level issue (we're anyway talking FTPS here, that's a legacy protocol that has other issues). Signed-off-by: Yann E. MORIN Signed-off-by: Thomas Petazzoni --- utils/genrandconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/utils/genrandconfig b/utils/genrandconfig index 66b7a87311..216e733799 100755 --- a/utils/genrandconfig +++ b/utils/genrandconfig @@ -677,6 +677,7 @@ async def gen_config(args): # Allow hosts with old certificates to download over https configlines.append("BR2_WGET=\"wget -nd -t 3 --no-check-certificate\"\n") + configlines.append("BR2_CURL=\"curl --ftp-pasv --retry 3 --insecure\"\n") # Per-package folder if randint(0, 15) == 0: