Bug 14108

Summary:	Don't ignore certificates in wget fetcher
Product:	[Build System, Metadata & Runtime] BitBake	Reporter:	Ross Burton <ross.burton>
Component:	bitbake	Assignee:	Ross Burton <ross.burton>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Medium+	CC:	poky.bs.watcher, poky.watcher, randy.macleod, tim.orling
Version:	3.3
Target Milestone:	3.4 M2
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	Yes (doc changes required)

Description Ross Burton 2020-10-26 04:03:34 UTC

Currently the http fetcher passes --no-check-certificate to wget, which means any SSL errors are ignored.

Whilst we have checksums for validation, this is not a good look and I believe we should remove this option.

I removed it locally and did a world fetch to a fresh DL_DIR of oe-core+meta-oe.  There were quite a few 404s from meta-oe, but nothing actually failed with SSL errors.

I'd like to hope that we can simply remove the option, as any sites that have broken SSL can hopefully be switched to use http: instead.

Comment 1 Tim Orling 2020-10-30 05:57:52 UTC

But at least ignored certificates prevent man-in-the-middle attacks that straight http won't?

The real solution is all the upstreams need valid certificates ;)

Comment 2 Ross Burton 2020-11-01 07:57:37 UTC

Good news: world fetch for oe-core+meta-oe resulted in no SSL failures.

Comment 3 Ross Burton 2020-11-05 07:41:51 UTC

As per Joshua Watt: please allow certificate checking to be disabled globally because some companies use MITM edge devices that break wget.

Comment 4 Ross Burton 2021-06-28 17:12:48 UTC

Patch on the list.

Comment 5 Ross Burton 2021-08-12 14:59:50 UTC

Fixed in bitbake 4104850dd36096a9ff01836c5fca9ac0e452bcf8.