Jira (PUP-3346) curl allows --insecure SSL connections

[Kylo Ginsberg (JIRA)]

Title: Message Title

Kylo Ginsberg commented on an issue   Re: curl allows --insecure SSL connections Daniele Sluijters IIRC in mavericks changes the ssl engine used by the system curl: http://curl.haxx.se/mail/archive-2013-10/0036.html. I just mention that because I don't know if that effects which versions of osx honor CURL_CA_BUNDLE? Regardless, are you suggesting we'd want to have the CA pem be a parameter to the provider? Or ...? Sean Knox any thoughts on the comments on this thread? Add Comment   Puppet / PUP-3346 curl allows --insecure SSL connections The {{appdmg}} and {{pkgdmg}} providers were calling {{curl}} with {{\-k}} (alias for {{--insecure}}) which allows curl'ing over insecure HTTPS connections. I can't see why this would ever be desired, and many connections will often fail when attempting establish a connection. I have a PR removing the insecure option: https://github.com/puppetlabs/pupp... This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.