Skip to content

ci: do not force HTTPS on apt

David Heidelberg requested to merge dh/mesa:less-paranoia into main

An attack on data in transit on the way to the CI machine is not meaningful. Just bloat our CI files and slow down downloads.

"APT verifies the signature of packages. So you do not need to have a form of transportation that provides data authentication. If an attacker modifies the files you're downloading, this will be noticed. Using a signature verification is better than using an HTTPS connection, because it'll detect an attack on the server you're downloading from, not just an attack in transit."

Ref: https://askubuntu.com/a/146117

Signed-off-by: David Heidelberg david.heidelberg@collabora.com

/cc @tomeu @anholt

Merge request reports