`mhc sync` uses insecure https connection about mhc HOT 3 CLOSED

Thanks.
I've changed verify_mode from VERIFY_NONE to VERIFY_PEER by 9e3c47e.

from mhc.

I've changed verify_mode from VERIFY_NONE to VERIFY_PEER by 9e3c47e.

Thank you. The change is enough for me. Closing.

FYI, in Debian's mhc 1.0.2-2, the following patch is used (and the
CA configuration is already set in the Ruby side). I'll drop this
patch in the next release.

• http://anonscm.debian.org/cgit/collab-maint/mhc.git/tree/debian/patches/030_https.patch?h=experimental&id=debian/1.0.2-2

  Subject: Verify certificates for mhc sync
  Author: Tatsuya Kinoshita <[email protected]>
  
  diff --git a/lib/mhc/webdav.rb b/lib/mhc/webdav.rb
  index d2b369b..d548619 100644
  --- a/lib/mhc/webdav.rb
  +++ b/lib/mhc/webdav.rb
  @@ -18,8 +18,10 @@ module Mhc
           uri = URI.parse(base_url)
           @top_directory = uri.path
           @http = Net::HTTP.new(uri.host, uri.port, proxy_host, proxy_port)
  -        @http.use_ssl = true if uri.scheme == "https"
  -        @http.verify_mode = OpenSSL::SSL::VERIFY_NONE
  +        if uri.scheme == "https"
  +          @http.use_ssl = true
  +          @http.verify_mode = OpenSSL::SSL::VERIFY_PEER
  +        end
         end
  
         def set_basic_auth(user, password)
  

from mhc.

Thanks for your support.
I'm very happy to know the Debian package is very up-to-date.

from mhc.