Issue #31: spectool --insecure default - rpmdevtools

rpmdevtools

#31 spectool --insecure default

Closed: Invalid Opened May 4, 2016 by bharper.

It seems strange that spectool uses curl's --insecure option as the default. The output does not give any indication that SSL verification was skipped for https URLs. Granted both --help and the man page state that /etc/rpmdevtools/curlrc contains optional curl configurations. It just seem at odd with current 'secure by default' practices.

scop commented May 5, 2016

My position and reasoning for that default is written in the subthread starting at:
http://thread.gmane.org/gmane.linux.redhat.fedora.devel/189125/focus=189259

Additionally, spectool as currently implemented in rpmdevtools is being phased out, and I'm keeping the changes to it in the bare minimum, at least wrt behavioral changes. The phase out will happen once a suitably compatible replacement emerges, see https://bugzilla.redhat.com/1279723

bharper commented May 5, 2016

Thanks for the timely reply. It makes sense not to make changes to the current spectool if it is getting replaced.