Re: [Christos Zoulas] CVS commit: src/usr.bin/ftp

[Martin Husemann <martin%duskware.de@localhost>]

On Fri, Sep 02, 2022 at 06:23:48PM +0300, Christos Zoulas wrote:
> I think we should be installing the anchors by default. I also think
> that people think that https gets validated by default.

I agree. The problem is that we need to suply anchors now with new
installations and have a way to keep them updated (and optionaly disabled).

Could be something easy like using the mozilla root certs from last quarters
pkgsrc branch, downloadable from some well known NetBSD.org URL.

Either the original bin pkg and a (special) base system script to unpack
and update (w/o pkg_add and architecture check), or some automatic
magic on the server side to rebundle them in the format expected by the
update script on the client side.

And some local overrides (as we usually have with this kind of tools) to
get a different bundle from a local URL or disable the whole update.

Martin