In src/curl.c (line 133), the condition if (verifyCert == True) triggers the disabling of SSL/TLS certificate peer and hostname verification:
if (verifyCert == True) {
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
}
In GAP, verifyCert defaults to true (as defined in gap/curl.gi). Consequently, default configurations will explicitly disable certificate validation under the hood. Conversely, setting verifyCert := false skips this block and leaves libcurl's default validation enabled.
This seems oddly the wrong way around?
In
src/curl.c(line 133), the conditionif (verifyCert == True)triggers the disabling of SSL/TLS certificate peer and hostname verification:In GAP,
verifyCertdefaults totrue(as defined ingap/curl.gi). Consequently, default configurations will explicitly disable certificate validation under the hood. Conversely, settingverifyCert := falseskips this block and leaves libcurl's default validation enabled.This seems oddly the wrong way around?