Use --insecure to download ca-certificates source where necessary

[Bo98]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

We've not been able to provide a HTTP mirror for this, so the second best solution is to pass --insecure while downloading, so it can indeed be downloaded when system CA certs are broken.

[BrewTestBot]

Review period skipped due to critical label.

[MikeMcQuaid]

@Bo98 Maybe provide some big warning here?

[Bo98]

@Bo98 Maybe provide some big warning here?

Given the user can do nothing about it, I'm not sure what that will really add. We don't warn when using plain HTTP mirrors, and we still verify the download via sha256 checksumming.

[MikeMcQuaid]

Given the user can do nothing about it, I'm not sure what that will really add. We don't warn when using plain HTTP mirrors, and we still verify the download via sha256 checksumming.

I think it's good practise to let them know that we are passing --insecure and why we are doing so.

[Bo98]

Oh right a notification type rather than "you're doing something bad".

[MikeMcQuaid]

@Bo98 Yeh, something like opoo "Using --insecure with curl because we need it to download anything else securely"

[carlocab]

Maybe error out too if I'm on old macOS and have HOMEBREW_NO_INSECURE_REDIRECT set? (Or does this already do that?)

[Bo98]

HOMEBREW_NO_INSECURE_REDIRECT only affects HTTPS -> HTTP redirects so it doesn't affect anything right now, but I could make setting --insecure conditional on that if it makes sense.

[carlocab]

I could make setting --insecure conditional on that if it makes sense.

Makes sense, yea 👍

[MikeMcQuaid]

Looks great, thanks. Feel feel free to create a release when this stuff drops 👍🏻

[carlocab]

Suggested change

	args += ["--insecure"] if meta[:insecure]
	args += ["--insecure"]

[Bo98]

Oops, will fix that.

[Rylan12]

Don't think it's required (and it might be too late anyway) but I wonder if it's worth adding a line that says something letting the user know that checksums are still being checked. I worry that this reads too much like "hey we're going to download some stuff that might not be safe we don't know 🤷" when in reality we're a lot more confident that this is actually going to be okay.

[Bo98]

Yeah, I agree: #12182