diff options
| -rw-r--r-- | config/Config-build.in | 4 | ||||
| -rw-r--r-- | rules.mk | 3 | ||||
| -rwxr-xr-x | scripts/download.pl | 6 |
3 files changed, 11 insertions, 2 deletions
diff --git a/config/Config-build.in b/config/Config-build.in index 400bf15665..2eded2b288 100644 --- a/config/Config-build.in +++ b/config/Config-build.in @@ -58,6 +58,10 @@ menu "Global build settings" bool "Enable signature checking in opkg" default SIGNED_PACKAGES + config DOWNLOAD_CHECK_CERTIFICATE + bool "Enable TLS certificate verification during package download" + default y + comment "General build options" config TESTING_KERNEL @@ -257,6 +257,9 @@ ESED:=$(STAGING_DIR_HOST)/bin/sed -E -i -e MKHASH:=$(STAGING_DIR_HOST)/bin/mkhash # MKHASH is used in /scripts, so we export it here. export MKHASH +# DOWNLOAD_CHECK_CERTIFICATE is used in /scripts, so we export it here. +DOWNLOAD_CHECK_CERTIFICATE:=$(CONFIG_DOWNLOAD_CHECK_CERTIFICATE) +export DOWNLOAD_CHECK_CERTIFICATE CP:=cp -fpR LN:=ln -sf XARGS:=xargs -r diff --git a/scripts/download.pl b/scripts/download.pl index af13c0ae00..ab1801aad5 100755 --- a/scripts/download.pl +++ b/scripts/download.pl @@ -24,6 +24,8 @@ my $scriptdir = dirname($0); my @mirrors; my $ok; +my $check_certificate = $ENV{DOWNLOAD_CHECK_CERTIFICATE} eq "y"; + $url_filename or $url_filename = $filename; sub localmirrors { @@ -80,8 +82,8 @@ sub download_cmd($) { } return $have_curl - ? (qw(curl -f --connect-timeout 20 --retry 5 --location --insecure), shellwords($ENV{CURL_OPTIONS} || ''), $url) - : (qw(wget --tries=5 --timeout=20 --no-check-certificate --output-document=-), shellwords($ENV{WGET_OPTIONS} || ''), $url) + ? (qw(curl -f --connect-timeout 20 --retry 5 --location), $check_certificate ? '' : '--insecure', shellwords($ENV{CURL_OPTIONS} || ''), $url) + : (qw(wget --tries=5 --timeout=20 --output-document=-), $check_certificate ? '' : '--no-check-certificate', shellwords($ENV{WGET_OPTIONS} || ''), $url) ; } |