Jira (PUP-7814) HTTPS file sources with non-puppet-trusted certs can't be used

[Eric Sorenson (JIRA)]

Title: Message Title

Eric Sorenson created an issue   Puppet / PUP-7814 HTTPS file sources with non-puppet-trusted certs can't be used Issue Type: Bug Assignee: Unassigned Created: 2017/08/02 2:51 PM Priority: Normal Reporter: Eric Sorenson In PUP-1072 we added support for http and https URL schemes for file resources' source attributes: file { '/tmp/myfile': source => 'https://myserver/myfile' } Somehow we failed to realize that the implementation of this feature requires that the remote webserver present a certificate that is trusted by the puppet agent's SSL configuration. In practice this is extremely unlikely and difficult to configure, and therefore the utility of this feature is pretty limited. In the code, this is because the request ultimately uses the same routines (in Puppet::Util::HttpProxy.get_http_object) that the agent itself uses, where the SSL verification mode is hardcoded but the certificate store is not. There should be some way to permit retrieval of these files. A couple of options that occured to me as I was tracing this down: 1. make the ssl verification mode configurable or disabled by default for file-source retrieval (equivalent to curl -k) 2. use the system-wide trust store instead of puppet's store 3. expose the certificate trust and verification mode as parameters on the file type (this is truly awful) ... surely someone else has better ideas ... Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.