Bug 14108 - Don't ignore certificates in wget fetcher
Summary: Don't ignore certificates in wget fetcher
Status: RESOLVED FIXED
Alias: None
Product: BitBake
Classification: Build System, Metadata & Runtime
Component: bitbake (show other bugs)
Version: 3.3
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: 3.4 M2
Assignee: Ross Burton
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2020-10-26 04:03 UTC by Ross Burton
Modified: 2021-08-12 14:59 UTC (History)
4 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Yes (doc changes required)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ross Burton 2020-10-26 04:03:34 UTC 
Currently the http fetcher passes --no-check-certificate to wget, which means any SSL errors are ignored.

Whilst we have checksums for validation, this is not a good look and I believe we should remove this option.

I removed it locally and did a world fetch to a fresh DL_DIR of oe-core+meta-oe.  There were quite a few 404s from meta-oe, but nothing actually failed with SSL errors.

I'd like to hope that we can simply remove the option, as any sites that have broken SSL can hopefully be switched to use http: instead.
Comment 1 Tim Orling 2020-10-30 05:57:52 UTC 
But at least ignored certificates prevent man-in-the-middle attacks that straight http won't?

The real solution is all the upstreams need valid certificates ;)
Comment 2 Ross Burton 2020-11-01 07:57:37 UTC 
Good news: world fetch for oe-core+meta-oe resulted in no SSL failures.
Comment 3 Ross Burton 2020-11-05 07:41:51 UTC 
As per Joshua Watt: please allow certificate checking to be disabled globally because some companies use MITM edge devices that break wget.
Comment 4 Ross Burton 2021-06-28 17:12:48 UTC 
Patch on the list.
Comment 5 Ross Burton 2021-08-12 14:59:50 UTC 
Fixed in bitbake 4104850dd36096a9ff01836c5fca9ac0e452bcf8.