6150 2014-04-10 16:38:46 +0000 SVN fetching trusts certificates by default 2026-10-01 15:48:11 +0000 1 1 7 Build System, Metadata & Runtime OE-Core configuration unspecified x86 Multiple NEW Low normal 6.2 1 zoltan.kuscsik richard.purdie ankur.tyagi85 pavel pokylinux randy.macleod richard.purdie --- --- Don't know oldest_to_newest 42556 0 zoltan.kuscsik 2014-04-10 16:38:46 +0000 Default configuration for SVN fetching always trusts the server certificate: meta/conf/bitbake.conf This introduces some risks when using bitbake in a secure environment. 42625 1 richard.purdie 2014-04-13 20:33:20 +0000 This has been the case for a long time, users tend to find it a pain to need to verify certificates for all svn urls. The user or distro can override the options from bitbake.conf for "secure" setups should that be necessary. I can't see a pressing need to change this. 42628 2 zoltan.kuscsik 2014-04-13 21:25:35 +0000 My view is that the current configuration should not be used in any build configuration where security is a concern. There are many situations where user don't need or don't care about downloading the source code securely, however, having this as a default configuration creates a false sense of security. Without certificate verification an attacker could replace code sequences that will be built in to the target system. 42818 3 richard.purdie 2014-04-22 15:05:06 +0000 I still don't see this to be a high priority issue however if you want to take it on and make it happen I have no objection, up to you really. 56671 4 zoltan.kuscsik 2015-11-20 05:39:44 +0000 I suggest to make it a warning. Sent a patch to the mailing list. //Zoli 86102 5 richard.purdie 2020-01-23 16:18:05 +0000 We still do: ud.basecmd = d.getVar("FETCHCMD_svn") or "/usr/bin/env svn --non-interactive --trust-server-cert" in lib/bb/fetch2/svn.py 86105 6 randy.macleod 2020-01-23 16:40:35 +0000 FYI, the patch is here: http://lists.openembedded.org/pipermail/bitbake-devel/2015-November/016452.html Zoltan, can you resend? If not, I'll get someone to test and submit the patch. 92419 7 richard.purdie 2022-01-27 16:09:31 +0000 Can we just drop the option from the commandline?