Nico Huber has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/47935 )
Change subject: util/crossgcc: Ignore TLS certificate issues ......................................................................
Patch Set 3: Code-Review+1
(1 comment)
IIRC, we were well aware that we do the hash checks anyway, and the reason to move to https was to make sure that no adversary can see the full URL (at least that's the only argument I remember that technically made sense). We'd lose that this way.
Honestly, I don't care. An alternative would be to offer to try again without certificate checks in case of failure, so the user would have a choice.
https://review.coreboot.org/c/coreboot/+/47935/3/util/crossgcc/buildgcc File util/crossgcc/buildgcc:
https://review.coreboot.org/c/coreboot/+/47935/3/util/crossgcc/buildgcc@1060 PS3, Line 1060: wget --tries=3 "$url" 2>&1 | while read -r line; do Should we add `--no-check-certificate` here?