Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel > #101605

Re: Bug#992692: general: Use https for {deb,security}.debian.org by default

Show all headers | View raw

On Wed, Sep 08, 2021 at 03:56:14PM +0200, Ansgar wrote:
>On Wed, 2021-09-08 at 15:41 +0200, Helmut Grohne wrote:
>> On Wed, Sep 08, 2021 at 02:01:03PM +0200, Ansgar wrote:
>> > So what do you suggest then? Tech-ctte as with merged-/usr? Or a
>> > GR? Or
>> > something else?
>>
>> I propose that the proponents pay the cost. In this case, it is a bit
>> unclear what that means precisely (which likely is the reason they
>> haven't done it already). At the very least though, apt install
>> auto-apt-proxy should continue to work on a default installation in a
>> sensible way.
>
>I can file a bug for auto-apt-proxy to include an apt.conf snippet
>saying
>
>  Acquire::https::Verify-Peer false;
>
>That clearly makes it work again

I think the issue isn't certificate validation, it's that https proxy 
requests are made via CONNECT rather than GET. You could theoretically 
rewrite the proxy mechanism to MITM the CONNECT, but that wouldn't be a 
drop-in replacement. I suppose you could instead add an apt option to 
pass the https request to the proxy via GET instead of using CONNECT, 
but I think that also won't necessarily work on an existing proxy.

If we're imagining apt options, something like 
Acquire::https::Force-Proxy-HTTP true;
would probably be more useful for this specific case (not that I think 
it's a great idea--too much potential for surprise).

Back to linux.debian.devel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#992692: general: Use https for {deb,security}.debian.org by default Hideki Yamane <henrich@debian.org> - 2021-08-22 15:10 +0200
  Processed: Re: Bug#992692: general: Use https for {deb,security}.debian.org  by default "Debian Bug Tracking System" <owner@bugs.debian.org> - 2021-09-01 11:50 +0200
  Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-01 11:50 +0200
    Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-01 12:00 +0200
      Bug#992692: general: Use https for {deb,security}.debian.org by default Russ Allbery <rra@debian.org> - 2021-09-01 17:00 +0200
        Bug#992692: general: Use https for {deb,security}.debian.org by default Hideki Yamane <henrich@iijmio-mail.jp> - 2021-09-02 04:00 +0200
          Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Roberto C. Sánchez <roberto@debian.org> - 2021-09-02 18:30 +0200
            Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Jeremy Stanley <fungi@yuggoth.org> - 2021-09-02 19:00 +0200
          Bug#992692: general: Use https for {deb,security}.debian.org by default Jeremy Stanley <fungi@yuggoth.org> - 2021-09-02 19:00 +0200
          Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-02 21:40 +0200
            Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-02 23:10 +0200
              Bug#992692: general: Use https for {deb,security}.debian.org by default Paul Wise <pabs@debian.org> - 2021-09-03 04:50 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default David Kalnischkies <david@kalnischkies.de> - 2021-09-05 12:40 +0200
              Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-03 13:20 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-03 13:40 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Philipp Kern <pkern@debian.org> - 2021-09-03 13:40 +0200
            Bug#992692: general: Use https for {deb,security}.debian.org by default Hideki Yamane <henrich@iijmio-mail.jp> - 2021-09-04 22:20 +0200
              Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-09 20:10 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Paul Wise <pabs@debian.org> - 2021-09-10 02:00 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-10 17:10 +0200
          Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 13:20 +0200
            Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 13:40 +0200
              Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 14:00 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 14:10 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 15:50 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 16:00 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-09 01:30 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Timothy M Butterworth <timothy.m.butterworth@gmail.com> - 2021-09-09 01:40 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Eduard Bloch <edi@gmx.de> - 2021-09-10 11:30 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Timo Röhling <roehling@debian.org> - 2021-09-10 12:10 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-10 14:00 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Tim Woodall <debiandevel@woodall.me.uk> - 2021-09-08 14:20 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 14:30 +0200
            Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-09 01:30 +0200
              Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Timo Röhling <roehling@debian.org> - 2021-09-09 08:40 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-09 14:40 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Timo Röhling <roehling@debian.org> - 2021-09-09 15:00 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-09 15:10 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Timo Röhling <roehling@debian.org> - 2021-09-09 15:30 +0200
              Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-09 15:00 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default David Kalnischkies <david@kalnischkies.de> - 2021-09-10 16:40 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-10 17:10 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default David Kalnischkies <david@kalnischkies.de> - 2021-09-10 20:10 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-10 21:20 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Paul Wise <pabs@debian.org> - 2021-09-12 05:20 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Holger Levsen <holger@layer-acht.org> - 2021-09-13 00:00 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default David Kalnischkies <david@kalnischkies.de> - 2021-09-13 15:10 +0200
              Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Helmut Grohne <helmut@subdivi.de> - 2021-09-10 09:40 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-10 10:20 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-10 14:10 +0200
                Bug#994409: task-laptop: please recommend automatic apt proxying Phil Morrell <debian@emorrp1.name> - 2021-09-15 19:20 +0200
                Re: task-laptop: please recommend automatic apt proxying Russ Allbery <rra@debian.org> - 2021-09-15 19:40 +0200
                Re: task-laptop: please recommend automatic apt proxying Russ Allbery <rra@debian.org> - 2021-09-15 19:40 +0200
  Bug#992692: next steps Hans-Christoph Steiner <hans@eds.org> - 2021-12-09 12:30 +0100
  Bug#992692: more steps towards this goal Hans-Christoph Steiner <hans@eds.org> - 2022-03-30 10:00 +0200
  Bug#992692: moar Hans-Christoph Steiner <hans@eds.org> - 2022-03-30 12:30 +0200
  Bug#992692: link Geert Stappers <stappers@stappers.nl> - 2022-03-30 12:50 +0200

csiph-web