[mike@mwxm4]

selfupdate.go

@@ -6,6 +6,11 @@
 // that block it brings no names that do not begin with "selfUpdate" or
 // "update".
 //
+// One thing to know before copying it on: this copy does not verify the TLS
+// certificate of the gitea it talks to — see updateClient at the foot of the
+// file, where it says what that costs. That is a decision taken for this estate
+// and not a property of the file; anywhere else, take it out again.
+//
 // It assumes the layout build.sh produces: one release per version, whose tag
 // is the bare number (2.1.6, a leading "v" is allowed), holding one asset
 // "<name>-<goos>-<goarch>" each — that is, exactly the files from ./bin. Under
@@ -16,6 +21,7 @@ package main
 
 import (
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -394,7 +400,22 @@ func (u selfUpdater) apiBase() (string, error) {
 
 // One time limit for all of it: the look costs a few hundred milliseconds, the
 // download a few megabytes — both may hang, but not forever.
-var updateClient = &http.Client{Timeout: 5 * time.Minute}
+//
+// The certificate is deliberately not verified. Machines in this estate that
+// carry no current trust store cannot build a path to the chain the gitea
+// serves, and fixing that on each of them was not the road taken. Be clear
+// about the price: anyone able to place themselves in the network path between
+// this program and the gitea can hand it any binary at all, and install() will
+// put that binary in place of the running one and it will be run. The probe
+// afterwards is no guard against this — a hostile binary prints whatever
+// version string is asked of it; the probe catches a truncated download, not a
+// substituted one. What is left protecting the update is the network itself.
+var updateClient = &http.Client{
+	Timeout: 5 * time.Minute,
+	Transport: &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	},
+}
 
 func updateGet(ctx context.Context, target string) (*http.Response, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, target, nil)