Bug#913740: fetch-url does not use --no-check-certificate on HTTP to HTTPS redirects
Am 21.11.2018 um 15:47 schrieb Mauricio Oliveira:
>> [...] I will note that it's also possible to copy additional
>> root certificates into the initrd pre-install. (At least it used to work
>> before HTTPS was generally available.)
> It looks like this requires rebuilding the initrd, which is some extra work
> (and unfortunately it does not allow using the already
> distributed/official files out there), [...]
Linux support specifying multiple files to be loaded as an initrd[1]. In
that case the content is merged and you can keep reusing the distributed
files, just adding your root certificates on top.
Yes, it requires extra work. So does preseeding.
Now maybe the argument is that there could be mirrors outside of your
control that redirect you to HTTPS and the root of trust is the GPG key
material embedded into the initrd. That's a fair point but I will note
that you did not actually list a use case, you just reported what didn't
work.
I guess I don't really object to your patch and am mostly questioning
the existence of the option in this day and age, which then means people
are encouraged to enable that rather than setup their infrastructure
correctly. But there might still be value in having that option
available with some signage on how to do it right.
Kind regards
Philipp Kern
[1] In EFI mode Linux is the one requesting the files. Otherwise the
boot loader can provide them, which works fine at least with grub and iPXE.
Reply to: