14108 2020-10-26 04:03:34 +0000 Don't ignore certificates in wget fetcher 2021-08-12 14:59:50 +0000 1 1 7 Build System, Metadata & Runtime BitBake bitbake 3.3 x86 Multiple RESOLVED FIXED Medium+ normal 3.4 M2 1 ross.burton ross.burton poky.bs.watcher poky.watcher randy.macleod tim.orling --- --- Yes (doc changes required) oldest_to_newest 88485 0 ross.burton 2020-10-26 04:03:34 +0000 Currently the http fetcher passes --no-check-certificate to wget, which means any SSL errors are ignored. Whilst we have checksums for validation, this is not a good look and I believe we should remove this option. I removed it locally and did a world fetch to a fresh DL_DIR of oe-core+meta-oe. There were quite a few 404s from meta-oe, but nothing actually failed with SSL errors. I'd like to hope that we can simply remove the option, as any sites that have broken SSL can hopefully be switched to use http: instead. 88525 1 tim.orling 2020-10-30 05:57:52 +0000 But at least ignored certificates prevent man-in-the-middle attacks that straight http won't? The real solution is all the upstreams need valid certificates ;) 88532 2 ross.burton 2020-11-01 07:57:37 +0000 Good news: world fetch for oe-core+meta-oe resulted in no SSL failures. 88551 3 ross.burton 2020-11-05 07:41:51 +0000 As per Joshua Watt: please allow certificate checking to be disabled globally because some companies use MITM edge devices that break wget. 90793 4 ross.burton 2021-06-28 17:12:48 +0000 Patch on the list. 91169 5 ross.burton 2021-08-12 14:59:50 +0000 Fixed in bitbake 4104850dd36096a9ff01836c5fca9ac0e452bcf8.