We will need to update to boto3 eventually, I think.  Boto just hit 2.45
just a month ago.  What's unclear is when validate_certs became a
parameter, and whether it has maintained that name throughout.  A simple
fix would be to add a kwargs parameter for anything above a set version,
but then we'd have to add another argument to duplicity to allow the user
to turn it off in some situations.

...Ken


On Thu, Jan 26, 2017 at 4:07 AM, edso <email address hidden> wrote:

> On 26.01.2017 04:47, az wrote:
> > according to the boto release notes for 2.6.0
> > (http://docs.pythonboto.org/en/latest/releasenotes/v2.6.0.html), boto
> > now defaults to certificate verification ON instead of opt-in.
> >
> > i think that's pretty much it, given that boto is now at version 2.45 or
> > so.
>
> stable is now boto3, any reason why we still stick with the boto2 ?
>
> > if that is considered not certain enough, then i think all that's
> necessary would be to
> > adjust duplicity/backends/_boto_single.py where storage_uri.connect()
> is called and change those
> > calls so that the validate_certs option is explicitely given.
> >
>
> nack.. that would break backward compatibility. we could do that for
> 0.8.x though..
>
> ..ede/duply.net
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1314234
>
> Title:
>   Duplicity does not verify SSL certificate prior to connecting
>
> Status in Duplicity:
>   New
> Status in Debian:
>   Confirmed
>
> Bug description:
>   While doing some testing using deja-dup I noticed that the SSL
>   certificate that Amazon S3 was providing wasn't correct.
>
>   $ openssl s_client -connect s3-1-w.amazonaws.com:443 -crlf
>   CONNECTED(00000003)
>   depth=3 C = US, O = "VeriSign, Inc.", OU = Class 3 Public Primary
> Certification Authority
>   verify return:1
>   depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU =
> "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3
> Public Primary Certification Authority - G5
>   verify return:1
>   depth=1 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU =
> Terms of use at https://www.verisign.com/rpa (c)10, CN = VeriSign Class 3
> Secure Server CA - G3
>   verify return:1
>   depth=0 C = US, ST = Washington, L = Seattle, O = Amazon.com Inc., CN =
> *.s3.amazonaws.com
>   verify return:1
>   ---
>   Certificate chain
>    0 s:/C=US/ST=Washington/L=Seattle/O=Amazon.com Inc./CN=*.
> s3.amazonaws.com
>      i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at
> https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA -
> G3
>    1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at
> https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA -
> G3
>      i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006
> VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary
> Certification Authority - G5
>    2 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006
> VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary
> Certification Authority - G5
>      i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification
> Authority
>
>   The Amazon certificate is a wildcard cert for *.s3.amazonaws.com.
>   Unfortunately the domain duplicity was connecting to was
>   s3-1-w.amazonaws.com.  Duplicity should have verified that the
>   certificate was valid for the domain it was connected to.
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/duplicity/+bug/1314234/+subscriptions
>