wget: https/ssl fails about repo HOT 8 CLOSED

Thanks, I'll add the patch then.

from repo.

mirror/busybox@fc2ce04 is the cause, will investigate further, might be due to libressl.

from repo.

It's because of this line. libressl does not have the -verify_hostname/-verify_ip flag available:

-> openssl s_client -quiet -connect duckduckgo.com:443 -servername duckduckgo.com -verify 100 -verify_return_error -verify_hostname duckduckgo.com

verify depth is 100
unknown option -verify_hostname
usage: s_client [-4 | -6] [-alpn protocols] [-bugs] [-CAfile file]...

@cemkeylan, have you encountered this on carbs ?

from repo.

On Carbs, we don't have ssl verification for busybox wget enabled, because we use bearssl, though I was planning to patch it to use bearssl. I see busybox's wget as the "if all else fails" option, and it already warns the user that the ssl verification is disabled, so I never bumped into such an issue.

from repo.

Hmm, so we can either revert the commit which fixed certificate verification or drop CONFIG_FEATURE_WGET_OPENSSL=y, both will lead to the verification being broken. For now atleast, i am just removing that option from .config and bumping release. Now wget will say wget: note: TLS certificate validation not implemented, people should use curl instead.

from repo.

Well, it is quite easy to patch out, so this should work with libressl.
libressl.patch.txt

By it should, I mean, I tried it with libressl and it works.

from repo.

Yes @cemkeylan, but is this actually effective in verifying the certificate stuff ? Because the linked commit "fixes" the openssl flags, so maybe it was silently "failing" to verify earlier due to missing flags ?

from repo.

It is effective for verification on most cases. Without the -verify_hostname bit, openssl will check whether the certificate is valid, has a trusted certificate authority, not self-singed, not revoked, and not expired. The verify_hostname bit also adds the check to verify that the hostname and DNS records match. This is also an important verification, though.

from repo.