Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes #18936 - checking server against CAs in TFTP module #792

Merged
merged 1 commit into from
Aug 2, 2021

Conversation

avitova
Copy link

@avitova avitova commented Jul 15, 2021

No description provided.

@theforeman-bot
Copy link
Member

Can one of the admins verify this patch?

@lzap
Copy link
Member

lzap commented Jul 15, 2021

Hello Anna and welcome to the community!

We require all commits to be in format of `Fixes #18936 - some short subject". We have a bot that enforces this. Can you please squash both commits into a single one with this commit message?

lib/proxy/http_download.rb Outdated Show resolved Hide resolved
@lzap
Copy link
Member

lzap commented Jul 15, 2021

Nice patch, thank you. I left a few nitpicks. There is an open question of the default value, let's discuss this with @ekohl and either keep it or change it.

@ekohl
Copy link
Member

ekohl commented Jul 15, 2021

Certainly a nice addition @avitova. I'm in favor of verifying certificates whenever you can. I also thought about the default. I'm torn between compatibility (current implementation) and security.

I'm leaning to merging this (after @lzap's comment have been addressed). Right now we're still not 100% certain if the next version will be 2.6 or 3.0 (to be decided in the next few days). If the next version is 3.0, then we can merge another patch that flips the default to be secure.

@lzap
Copy link
Member

lzap commented Jul 19, 2021

I do not know why tests are started: [test]

@evgeni
Copy link
Member

evgeni commented Jul 19, 2021

ok to test

@ekohl
Copy link
Member

ekohl commented Jul 20, 2021

I think something went wrong in merging it. You should rebase, not merge develop into your branch.

@avitova
Copy link
Author

avitova commented Jul 20, 2021

Yes, I tried to rebase but unfortunately was not able to and somehow broke it. I will discuss it with lzap soon and clean all the mess hopefully.

@avitova avitova force-pushed the avito branch 2 times, most recently from 4529cbe to 66b1190 Compare July 21, 2021 07:30
Copy link
Member

@lzap lzap left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you

@ekohl ekohl changed the title Bug 18936, --no-check-parameter default Fixes #18936 - checking server against CAs Jul 21, 2021
@ekohl ekohl changed the title Fixes #18936 - checking server against CAs Fixes #18936 - checking server against CAs in TFTP module Jul 21, 2021
Copy link
Member

@ekohl ekohl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code wise 👍 but I'd like to see a bit more descriptive commit message. I already added TFTP to the PR title. https://chris.beams.io/posts/git-commit/ has a lot more tips.

@lzap
Copy link
Member

lzap commented Jul 21, 2021

Oh yeah, if you could add "TFTP" into the commit subject that would be better.

@avitova
Copy link
Author

avitova commented Jul 21, 2021

Thank you, next time I'll focus on the message bit more.

@lzap
Copy link
Member

lzap commented Jul 21, 2021

For the record, I told Anna not to exceed 50 characters in commit subjects, but it's not a hard rule. If you exceed and the subject cannot be reasonably shortened, it is fine. Just do not waste space, do not use articles, just the simplest meaningful statement.

@lzap
Copy link
Member

lzap commented Jul 21, 2021

For the record, I tested that wget accepts arguments at the very end after the URL:

wget -O /dev/null https://downloads.theforeman.org/devconf-youtube-link.txt --no-check-certificate

Works fine, please rebase the subject change and we are merging. Thanks.

@ekohl
Copy link
Member

ekohl commented Jul 21, 2021

One thing I see a lot of people do wrong is not using the imperative mood (https://chris.beams.io/posts/git-commit/#imperative). So I'd write Check server certs in the TFTP module.

@lzap
Copy link
Member

lzap commented Jul 22, 2021

Can you remove the trailing dot? Read the guide that Ewoud linked above, these are unwanted :-)

@avitova
Copy link
Author

avitova commented Jul 22, 2021

Sure, I actually did read it, but using the dot when starting with capital, is my habit, an unpleasant one in this case. I'm sorry, it should be fixed by now.

@avitova
Copy link
Author

avitova commented Jul 25, 2021

I pushed while on the wrong branch, nothing has changed. Hopefully it will not be a problem.

Copy link
Member

@lzap lzap left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@lzap lzap merged commit 040da58 into theforeman:develop Aug 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants