Support insecure updates over HTTP

Fixes: clearlinux#478 Add new --allow-insecure-http flag to support the use of HTTP URLs. This is needed to allow swupd to download content from http sites; generally development mixes. Also enable the use of the setting in both the TUI and GUI to allow the user to set a swupd mirror which is HTTP. Signed-off-by: Mark D Horn <[email protected]>
be-we · Oct 1, 2019 · 2e3c5bf · 2e3c5bf
1 parent fb300cd
commit 2e3c5bf
Show file tree

Hide file tree

Showing 13 changed files with 220 additions and 51 deletions.
diff --git a/args/args.go b/args/args.go
@@ -1,4 +1,4 @@
-// Copyright © 2018 Intel Corporation
+// Copyright © 2019 Intel Corporation
 //
 // SPDX-License-Identifier: GPL-3.0-only
 
@@ -49,6 +49,8 @@ type Args struct {
  CfDownloaded bool
  CfPurge bool
  CfPurgeSet bool
+ AllowInsecureHTTP bool
+ AllowInsecureHTTPSet bool
  CryptPassFile string
  SwupdMirror string
  SwupdStateDir string
@@ -243,6 +245,10 @@ func (args *Args) setCommandLineArgs() (err error) {
  log.LogLevelDebug, log.LogLevelInfo, log.LogLevelWarning, log.LogLevelError),
  )
 
+ flag.BoolVar(
+ &args.AllowInsecureHTTP, "allow-insecure-http", false, "Allow installation over insecure connections",
+ )
+
  flag.BoolVar(
  &args.Archive, "archive", true, "Archive data to target after finishing",
  )
@@ -325,6 +331,13 @@ func (args *Args) setCommandLineArgs() (err error) {
  }
  }
 
+ fflag = flag.Lookup("allow-insecure-http")
+ if fflag != nil {
+ if fflag.Changed {
+ args.AllowInsecureHTTPSet = true
+ }
+ }
+
  fflag = flag.Lookup("archive")
  if fflag != nil {
  if fflag.Changed {

diff --git a/clr-installer/main.go b/clr-installer/main.go
@@ -1,4 +1,4 @@
-// Copyright © 2018 Intel Corporation
+// Copyright © 2019 Intel Corporation
 //
 // SPDX-License-Identifier: GPL-3.0-only
 
@@ -132,10 +132,6 @@ func execute(options args.Args) error {
  log.Info(path.Base(os.Args[0]) + ": " + model.Version +
  ", built on " + model.BuildDate)
 
- if options.SwupdContentURL != "" && swupd.IsValidMirror(options.SwupdContentURL) == false {
- return errors.Errorf("swupd-contenturl %s must use HTTPS or FILE protocol", options.SwupdContentURL)
- }
-
  if options.PamSalt != "" {
  hashed, errHash := encrypt.Crypt(options.PamSalt)
  if errHash != nil {
@@ -279,6 +275,14 @@ func execute(options args.Args) error {
  md.SwupdMirror = options.SwupdMirror
  }
 
+ if options.AllowInsecureHTTPSet {
+ md.AllowInsecureHTTP = options.AllowInsecureHTTP
+ }
+
+ if options.SwupdContentURL != "" && swupd.IsValidMirror(options.SwupdContentURL, md.AllowInsecureHTTP) == false {
+ return errors.Errorf("swupd-contenturl %s must use HTTPS or FILE protocol", options.SwupdContentURL)
+ }
+
  // Command line overrides the configuration file
  if options.MakeISOSet {
  md.MakeISO = options.MakeISO
@@ -305,7 +309,7 @@ func execute(options args.Args) error {
  // Now validate the mirror from the config or command line
  if md.SwupdMirror != "" {
  var url string
- url, err = swupd.SetHostMirror(md.SwupdMirror)
+ url, err = swupd.SetHostMirror(md.SwupdMirror, md.AllowInsecureHTTP)
  if err != nil {
  return err
  }

diff --git a/controller/controller.go b/controller/controller.go
@@ -393,6 +393,12 @@ func Install(rootDir string, model *model.SystemInstall, options args.Args) erro
  }
  }
 
+ swupd.CopyConfigurations(rootDir)
+
+ if model.AllowInsecureHTTP {
+ swupd.CreateConfig(rootDir)
+ }
+
  if model.Telemetry.URL != "" {
  if err = model.Telemetry.CreateTelemetryConf(rootDir); err != nil {
  return err
@@ -471,7 +477,7 @@ func contentInstall(rootDir string, version string, md *model.SystemInstall, opt
 
  var prg progress.Progress
 
- sw := swupd.New(rootDir, options)
+ sw := swupd.New(rootDir, options, md.AllowInsecureHTTP)
 
  bundles := md.Bundles
 

diff --git a/gui/pages/swupd_config.go b/gui/pages/swupd_config.go
@@ -5,6 +5,8 @@
 package pages
 
 import (
+ "strings"
+
  "github.com/gotk3/gotk3/gtk"
 
  "github.com/clearlinux/clr-installer/gui/common"
@@ -23,6 +25,7 @@ type SwupdConfigPage struct {
  mirrorDesc *gtk.Label
  mirrorEntry *gtk.Entry
  mirrorWarning *gtk.Label
+ insecureCheck *gtk.CheckButton
  autoUpdateTitle *gtk.Label
  autoUpdateDesc *gtk.Label
  autoUpdateButton *gtk.CheckButton
@@ -90,6 +93,33 @@ func NewSwupdConfigPage(controller Controller, model *model.SystemInstall) (Page
  return nil, err
  }
 
+ page.insecureCheck, err = gtk.CheckButtonNew()
+ if err != nil {
+ return nil, err
+ }
+ page.insecureCheck.SetLabel(" " + utils.Locale.Get(swupd.MirrorAllowInsecure))
+ page.insecureCheck.SetMarginStart(14) // Custom margin to align properly
+ page.insecureCheck.SetHAlign(gtk.ALIGN_START) // Ensures that clickable area is only within the label
+ page.box.PackStart(page.insecureCheck, false, false, 10)
+ if _, err := page.insecureCheck.Connect("clicked", func(button *gtk.CheckButton) {
+ if button.GetActive() {
+ page.model.AllowInsecureHTTP = true
+ } else {
+ page.model.AllowInsecureHTTP = false
+ }
+
+ page.validateMirror()
+ }); err != nil {
+ return nil, err
+ }
+
+ separator, err := gtk.SeparatorNew(gtk.ORIENTATION_HORIZONTAL)
+ if err != nil {
+ return nil, err
+ }
+ separator.ShowAll()
+ page.box.Add(separator)
+
  // Auto Updates
  page.autoUpdateTitle, err = setLabel(utils.Locale.Get(swupd.AutoUpdateTitle), "label-entry", 0.0)
  if err != nil {
@@ -98,7 +128,7 @@ func NewSwupdConfigPage(controller Controller, model *model.SystemInstall) (Page
  page.autoUpdateTitle.SetMarginStart(common.StartEndMargin)
  page.autoUpdateTitle.SetMarginTop(common.TopBottomMargin)
  page.autoUpdateTitle.SetHAlign(gtk.ALIGN_START)
- page.box.PackStart(page.autoUpdateTitle, false, false, 0)
+ page.box.PackStart(page.autoUpdateTitle, false, false, 10)
 
  desc = utils.Locale.Get(swupd.AutoUpdateDesc1)
  desc += "\n"
@@ -153,7 +183,7 @@ func NewSwupdConfigPage(controller Controller, model *model.SystemInstall) (Page
 func (page *SwupdConfigPage) onMirrorChange(entry *gtk.Entry) {
  mirror := getTextFromEntry(entry)
  page.mirrorWarning.SetText("")
- if mirror != "" && swupd.IsValidMirror(mirror) == false {
+ if mirror != "" && swupd.IsValidMirror(mirror, page.model.AllowInsecureHTTP) == false {
  page.mirrorWarning.SetText(utils.Locale.Get(swupd.InvalidURL))
  }
 
@@ -170,14 +200,14 @@ func (page *SwupdConfigPage) validateMirror() {
  page.model.SwupdMirror = mirror // success
  }
  } else {
- url, err := swupd.SetHostMirror(mirror)
+ url, err := swupd.SetHostMirror(mirror, page.model.AllowInsecureHTTP)
  if err != nil {
- page.mirrorWarning.SetText(err.Error()) // failure
+ page.mirrorWarning.SetText(err.Error())
  } else {
- if url != mirror { // At this point, url and mirror are expected to be the same
+ if url != strings.TrimRight(mirror, "/ ") { // swupd will drop all trailing /s
  page.mirrorWarning.SetText(utils.Locale.Get(swupd.IncorrectMirror)) // failure
  } else {
- page.model.SwupdMirror = mirror // success
+ page.model.SwupdMirror = url // success
  }
  }
  }

diff --git a/isoutils/isoutils.go b/isoutils/isoutils.go
@@ -162,7 +162,7 @@ func mkInitrd(version string, model *model.SystemInstall, options args.Args) err
  var err error
  options.SwupdStateDir = tmpPaths[clrInitrd] + "/var/lib/swupd/"
  options.SwupdFormat = "staging"
- sw := swupd.New(tmpPaths[clrInitrd], options)
+ sw := swupd.New(tmpPaths[clrInitrd], options, model.AllowInsecureHTTP)
 
  /* Install os-core and os-core-plus (we only need kmod-bin) as initrd */
  if err := sw.VerifyWithBundles(version, model.SwupdMirror, "ISO Initrd: ", []string{"os-core-plus"}); err != nil {

diff --git a/locale/en_US/LC_MESSAGES/clr-installer.po b/locale/en_US/LC_MESSAGES/clr-installer.po
@@ -771,3 +771,6 @@ msgstr "Use existing partition."
 
 msgid "Encrypted"
 msgstr "Encrypted"
+
+msgid "Allow installation over insecure connections (http:https://)"
+msgstr "Allow installation over insecure connections (http:https://)"
diff --git a/locale/es_MX/LC_MESSAGES/clr-installer.po b/locale/es_MX/LC_MESSAGES/clr-installer.po
@@ -771,3 +771,6 @@ msgstr "Utilice la partición existente."
 
 msgid "Encrypted"
 msgstr "Encriptado"
+
+msgid "Allow installation over insecure connections (http:https://)"
+msgstr "Permitir la instalación a través de conexiones inseguras (http:https://)"
diff --git a/locale/zh_CN/LC_MESSAGES/clr-installer.po b/locale/zh_CN/LC_MESSAGES/clr-installer.po
@@ -771,3 +771,6 @@ msgstr "使用现有分区。"
 
 msgid "Encrypted"
 msgstr "加密"
+
+msgid "Allow installation over insecure connections (http:https://)"
+msgstr "允许在不安全的连接（http:https://）上安装"
diff --git a/model/model.go b/model/model.go
@@ -65,6 +65,7 @@ type SystemInstall struct {
  Kernel *kernel.Kernel `yaml:"kernel,omitempty,flow"`
  PostReboot bool `yaml:"postReboot,omitempty,flow"`
  SwupdMirror string `yaml:"swupdMirror,omitempty,flow"`
+ AllowInsecureHTTP bool `yaml:"AllowInsecureHTTP,omitempty,flow"`
  PostArchive bool `yaml:"postArchive,omitempty,flow"`
  Hostname string `yaml:"hostname,omitempty,flow"`
  AutoUpdate bool `yaml:"autoUpdate,flow"`

diff --git a/scripts/InstallerYAMLSyntax.md b/scripts/InstallerYAMLSyntax.md
@@ -120,6 +120,7 @@ Item | Description | Default
 `kernel` | Kernel bundle to be used | kernel-native
 `httpsProxy` | HTTPS Proxy as a string | `-UNDEFINED-`
 `swupdMirror` | URL of the swupd stream to use. Useful for installing from a local mirror or from a locally published mix. | `-UNDEFINED-`
+`allowInsecureHttp` | Allow installation over insecure connections | false
 `hostname` | Name of the host system | `-UNIQUE RANDOM-`
 `version` | Version of Clear Linux OS to install | `-VERSION_ON_BUILD_SYSTEM-`
 `autoUpdate` | Should the system automatically update to the latest release of Clear Linux OS as part of the installation?; true or false | true