[pca] back and annoyed

[Martin Paul]

Don O'Malley wrote:
> I have confirmed that the patchdiag.xerf will remain on SunSolve.

Thanks. I guess I will make pca use HTTPS for the xref file when wget 
supports it, and HTTP if it doesn't (as a fallback) and deprecate 
--ssprot (as soon as I know what's going to happen with the READMEs).

> I have version 1.10.2 installed and always use "--no-check-certificate"
 > with wget. I'm not seeing any issue with this.

What I meant is that it shouldn't be necessary to use 
--no-check-certificate with wget at all :)

Somebody may correct me, but the main reason to use HTTPS over HTTP 
(esp. when downloading patches) is the server authentication, so you can 
be sure that you are getting the patches from Sun and not from some 
rogue server. By not checking the certificate this is defeated. The wget 
manual says:

   Only use this option if you are otherwise convinced of the site's
   authenticity, or if you really don't care about the validity of its
   certificate.

Now sunsolve.sun.com *does* have a certificate which is signed by one of 
the usual certificate authorities. All browsers include these root CA 
certs, so verification works fine there. openssl/wget on Linux 
distributions come with the root CA certs by default, too.

In pca I'm using a workaround - I include the necessary root CA cert in 
pca itself, and point wget at it with its --ca-certificate option. 
That's why I don't need to use --no-check-certificate.

Of course there's a second advantage with using HTTPS - encryption. But 
as the files which are transferred (patches) aren't really secret - 
anyone with a support contract can access them - it's less important 
than authentication.

Martin.