Jira (PUP-3346) curl allows --insecure SSL connections

Josh Cooper (JIRA) Mon, 08 Dec 2014 14:45:44 -0800

Title: Message Title

Josh Cooper commented on

PUP-3346

Verified that appdmg no longer uses curl's -k flag:

manifest:

package { 'Gephi':

  ensure   => installed,

  source   => 'https://launchpadlibrarian.net/98903476/gephi-0.8.1-beta.dmg',

  provider => appdmg,

$ sudo bundle exec puppet apply gephi.pp --debug

...

Debug: Prefetching appdmg resources for package

Debug: Executing '/usr/bin/curl -o /tmp/d20141208-14355-1rb253i/Gephi -C - -L -s --url https://launchpadlibrarian.net/98903476/gephi-0.8.1-beta.dmg'

Debug: Success: curl transferred [Gephi]

Debug: Executing '/usr/bin/hdiutil mount -plist -nobrowse -readonly -mountrandom /tmp /tmp/d20141208-14355-1rb253i/Gephi'

Debug: Executing '/usr/bin/ditto --rsrc /private/tmp/dmg.Z2wLMs/gephi.app /Applications/gephi.app'

Debug: Executing '/usr/bin/hdiutil eject /private/tmp/dmg.Z2wLMs'

Notice: /Stage[main]/Main/Package[Gephi]/ensure: created

Similarly, changing the provider => pkgdmg, and re-running, the -k flag is not used:

Debug: Executing '/usr/bin/curl -o /tmp/d20141208-15117-1qbcxc8/Gephi.dmg -C - -L -s --fail --url https://launchpadlibrarian.net/98903476/gephi-0.8.1-beta.dmg'

I'm going to resolve this ticket as it solves the immediate issue of not allowing insecure SSL connections.

The issue about how to manage the CA certs that curl uses to authenticate the SSL server is still an open issue. However, starting in Mavericks, curl uses the native mac keychain: http://curl.haxx.se/mail/archive-2013-10/0036.html, so you should be able to install new ca certs as needed.

Add Comment

This message was sent by Atlassian JIRA

--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To post to this group, send email to [email protected].
Visit this group at http://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.

Jira (PUP-3346) curl allows --insecure SSL connections

Reply via email to