Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use --insecure to download ca-certificates source where necessary #12172

Merged
merged 1 commit into from
Oct 4, 2021
Merged

Use --insecure to download ca-certificates source where necessary #12172

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions Library/Homebrew/download_strategy.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -544,6 +544,15 @@ def _curl_args

args += [meta[:header], meta[:headers]].flatten.compact.flat_map { |h| ["--header", h.strip] }

if meta[:insecure]
unless @insecure_warning_shown
opoo "Using --insecure with curl to download `ca-certificates` " \
"because we need it installed to download securely."
Comment on lines +549 to +550
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't think it's required (and it might be too late anyway) but I wonder if it's worth adding a line that says something letting the user know that checksums are still being checked. I worry that this reads too much like "hey we're going to download some stuff that might not be safe we don't know 🤷" when in reality we're a lot more confident that this is actually going to be okay.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I agree: #12182

@insecure_warning_shown = true
end
args += ["--insecure"] if meta[:insecure]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
args += ["--insecure"] if meta[:insecure]
args += ["--insecure"]

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops, will fix that.

end

args
end

Expand Down
13 changes: 11 additions & 2 deletions Library/Homebrew/resource.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,11 @@ def initialize(name = nil, &block)
def owner=(owner)
@owner = owner
patches.each { |p| p.owner = owner }

return if !owner.respond_to?(:full_name) || owner.full_name != "ca-certificates"
return if Homebrew::EnvConfig.no_insecure_redirect?

@specs[:insecure] = !specs[:bottle] && !DevelopmentTools.ca_file_handles_most_https_certificates?
end

def downloader
Expand Down Expand Up @@ -170,10 +175,14 @@ def sha256(val)
def url(val = nil, **specs)
return @url if val.nil?

specs = specs.dup
# Don't allow this to be set.
specs.delete(:insecure)

@url = val
@specs.merge!(specs)
@using = @specs.delete(:using)
@using = specs.delete(:using)
@download_strategy = DownloadStrategyDetector.detect(url, using)
@specs.merge!(specs)
@downloader = nil
end

Expand Down
2 changes: 1 addition & 1 deletion Library/Homebrew/software_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,8 +310,8 @@ def extname
def initialize(formula, spec, tag = nil)
@name = formula.name
@resource = Resource.new
@resource.owner = formula
@resource.specs[:bottle] = true
@resource.owner = formula
@spec = spec

tag_spec = spec.tag_specification_for(Utils::Bottles.tag(tag))
Expand Down