Merge lp:~jani/goget-ubuntu-touch/tls-skip-verify into lp:goget-ubuntu-touch

[Jani Monoses]

ubuntuimage: allow disabling the verification of TLS certificates.

Allow disabling the verification of TLS certificates via a command line flag, useful for connecting to servers using self-signed certificates.

Without the flag set the error looks like this

2014/04/16 18:02:28 Get https://localhost:10443/channels.json: x509: certificate signed by unknown authority

[Jani Monoses (jani)]

The naming could probably be better. Also unless this is the only arg we want to pass to the ubuntuimage code another function will be required, linke ubuntuimage.Initialize(args). I initially had HTTPOptions() until I realized I do not need to pass explicit args for HTTP basic authentication, as they can be part of the URL like http://user:pass@server/...

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:34
http://jenkins.qa.ubuntu.com/job/goget-ubuntu-touch-ci/28/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/goget-ubuntu-touch-trusty-amd64-ci/28
    SUCCESS: http://jenkins.qa.ubuntu.com/job/goget-ubuntu-touch-trusty-armhf-ci/28
    SUCCESS: http://jenkins.qa.ubuntu.com/job/goget-ubuntu-touch-trusty-i386-ci/28

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/goget-ubuntu-touch-ci/28/rebuild

review: Approve (continuous-integration)

[Sergio Schvezov (sergiusens)]

On Wed, Apr 16, 2014 at 12:43 PM, Jani Monoses
<email address hidden> wrote:
> Jani Monoses has proposed merging lp:~jani/goget-ubuntu-touch/tls-skip-verify into lp:goget-ubuntu-touch.
>
> Commit message:
> Allow disabling the verification of TLS certificates.

Can you set it to
ubuntuimage: allow...

as this is used in debian/changelog as well and makes it faster to read.

...

> +var client = &http.Client{}
> +
> +func TLSSkipVerify() {
> + tr := &http.Transport{
> + TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
> + }
> + client = &http.Client{Transport: tr}
> +}

Can you add a godoc string to this? I plan to add that to the missing
ones as well;

thanks

[lp:~jani/goget-ubuntu-touch/tls-skip-verify]

35. By Jani Monoses on 2014-04-16

Add docstring

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:35
http://jenkins.qa.ubuntu.com/job/goget-ubuntu-touch-ci/31/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/goget-ubuntu-touch-trusty-amd64-ci/31
    SUCCESS: http://jenkins.qa.ubuntu.com/job/goget-ubuntu-touch-trusty-armhf-ci/31
    SUCCESS: http://jenkins.qa.ubuntu.com/job/goget-ubuntu-touch-trusty-i386-ci/31

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/goget-ubuntu-touch-ci/31/rebuild

review: Approve (continuous-integration)

[Sergio Schvezov (sergiusens)]

The non skipping TLS path works fine still; can't say much for the non checking path

Thanks

review: Approve

=== modified file 'ubuntu-device-flash/args.go'
--- ubuntu-device-flash/args.go	2014-03-10 17:33:08 +0000
+++ ubuntu-device-flash/args.go	2014-04-16 17:01:09 +0000
@@ -25,15 +25,16 @@
 )
 
 type arguments struct {
-	Revision     int    `long:"revision" description:"revision to flash, absolute or relative allowed"`
-	Bootstrap    bool   `long:"bootstrap" description:"bootstrap the system, do this from the bootloader"`
-	ListChannels bool   `long:"list-channels" description:"List available channels"`
-	Wipe         bool   `long:"wipe" description:"Clear all data after flashing"`
-	Channel      string `long:"channel" description:"Specify an alternate channel"`
-	Device       string `long:"device" description:"Specify the device to flash"`
-	Serial       string `long:"serial" description:"Serial of the device to operate"`
-	Server       string `long:"server" description:"Use a different image server"`
-	CleanCache   bool   `long:"clean-cache" description:"Cleans up cache with all downloaded bits"`
+	Revision      int    `long:"revision" description:"revision to flash, absolute or relative allowed"`
+	Bootstrap     bool   `long:"bootstrap" description:"bootstrap the system, do this from the bootloader"`
+	ListChannels  bool   `long:"list-channels" description:"List available channels"`
+	Wipe          bool   `long:"wipe" description:"Clear all data after flashing"`
+	Channel       string `long:"channel" description:"Specify an alternate channel"`
+	Device        string `long:"device" description:"Specify the device to flash"`
+	Serial        string `long:"serial" description:"Serial of the device to operate"`
+	Server        string `long:"server" description:"Use a different image server"`
+	CleanCache    bool   `long:"clean-cache" description:"Cleans up cache with all downloaded bits"`
+	TLSSkipVerify bool   `long:"tls-skip-verify" description:"Skip TLS certificate validation"`
 }
 
 var args arguments

=== modified file 'ubuntu-device-flash/main.go'
--- ubuntu-device-flash/main.go	2014-04-16 11:43:38 +0000
+++ ubuntu-device-flash/main.go	2014-04-16 17:01:09 +0000
@@ -40,6 +40,9 @@
 	if _, err := parser.Parse(); err != nil {
 		os.Exit(1)
 	}
+	if args.TLSSkipVerify {
+		ubuntuimage.TLSSkipVerify()
+	}
 	cacheDir := ubuntuimage.GetCacheDir()
 	if args.CleanCache {
 		log.Print("Cleaning prevously downloaded content")

=== modified file 'ubuntuimage/channels.go'
--- ubuntuimage/channels.go	2014-04-14 19:31:15 +0000
+++ ubuntuimage/channels.go	2014-04-16 17:01:09 +0000
@@ -21,6 +21,7 @@
 
 import (
 	_ "crypto/sha512"
+	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -32,8 +33,19 @@
 	FULL_IMAGE   = "full"
 )
 
+var client = &http.Client{}
+
+// TLSSkipVerify turns off validation of server TLS certificates. It allows connecting
+// to HTTPS servers that use self-signed certificates.
+func TLSSkipVerify() {
+	tr := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	}
+	client = &http.Client{Transport: tr}
+}
+
 func NewChannels(server string) (channels Channels, err error) {
-	resp, err := http.Get(server + channelsPath)
+	resp, err := client.Get(server + channelsPath)
 	if err != nil {
 		return channels, err
 	}
@@ -53,7 +65,7 @@
 			device, server, channel)
 	}
 	channelUri := server + channels[channel].Devices[device].Index
-	resp, err := http.Get(channelUri)
+	resp, err := client.Get(channelUri)
 	if err != nil {
 		return deviceChannel, err
 	}

=== modified file 'ubuntuimage/images.go'
--- ubuntuimage/images.go	2014-04-16 11:43:38 +0000
+++ ubuntuimage/images.go	2014-04-16 17:01:09 +0000
@@ -27,7 +27,6 @@
 	"fmt"
 	"io"
 	"io/ioutil"
-	"net/http"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -163,7 +162,7 @@
 }
 
 func download(uri string, writer io.Writer) (err error) {
-	resp, err := http.Get(uri)
+	resp, err := client.Get(uri)
 	if err != nil {
 		return err
 	}