| Summary: | SVN fetching trusts certificates by default | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] OE-Core | Reporter: | Zoltan Kuscsik <zoltan.kuscsik> |
| Component: | configuration | Assignee: | Richard Purdie <richard.purdie> |
| Status: | NEW --- | QA Contact: | |
| Severity: | normal | ||
| Priority: | Low | CC: | ankur.tyagi85, pavel, pokylinux, randy.macleod, richard.purdie |
| Version: | unspecified | ||
| Target Milestone: | 6.2 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | Don't know | |
|
Description
Zoltan Kuscsik
2014-04-10 16:38:46 UTC
This has been the case for a long time, users tend to find it a pain to need to verify certificates for all svn urls. The user or distro can override the options from bitbake.conf for "secure" setups should that be necessary. I can't see a pressing need to change this. My view is that the current configuration should not be used in any build configuration where security is a concern. There are many situations where user don't need or don't care about downloading the source code securely, however, having this as a default configuration creates a false sense of security. Without certificate verification an attacker could replace code sequences that will be built in to the target system. I still don't see this to be a high priority issue however if you want to take it on and make it happen I have no objection, up to you really. I suggest to make it a warning. Sent a patch to the mailing list. //Zoli We still do:
ud.basecmd = d.getVar("FETCHCMD_svn") or "/usr/bin/env svn --non-interactive --trust-server-cert"
in lib/bb/fetch2/svn.py
FYI, the patch is here: http://lists.openembedded.org/pipermail/bitbake-devel/2015-November/016452.html Zoltan, can you resend? If not, I'll get someone to test and submit the patch. Can we just drop the option from the commandline? |