feat: enable insecure mode via INSECURE environment variable #247
Conversation
- Change INSECURE configuration to be enabled by presence of the INSECURE variable, replacing the previous true/false CURL_INSECURE approach - Update documentation in English and Chinese (Simplified, Traditional) to reflect INSECURE variable usage - Add usage examples showing how to enable insecure mode via INSECURE=1 - Remove validation checks for CURL_INSECURE value and all references to CURL_INSECURE in the script - Use INSECURE_ARG for curl invocations to manage SSL verification according to the new logic Signed-off-by: appleboy <[email protected]>
WalkthroughThe environment variable controlling SSL verification in installation scripts and documentation has been renamed from Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant install.sh
participant curl
User->>install.sh: Set INSECURE=1 and run script
install.sh->>install.sh: Check if INSECURE is set
alt INSECURE is set
install.sh->>install.sh: Set INSECURE_ARG="--insecure"
install.sh->>User: Print warning about insecure downloads
else INSECURE is not set
install.sh->>install.sh: INSECURE_ARG=""
end
install.sh->>curl: Download files with or without --insecure
Estimated code review effort🎯 2 (Simple) | ⏱️ ~7 minutes Poem
Note 🔌 MCP (Model Context Protocol) integration is now available in Early Access!Pro users can now connect to remote MCP servers under the Integrations page to get reviews and chat conversations that understand additional development context. ✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @appleboy, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
I've updated the installation script to simplify how insecure mode is enabled. Instead of using CURL_INSECURE with true/false values, it now uses the presence of an INSECURE environment variable. This change streamlines the configuration and is reflected across all documentation.
Highlights
- Simplified Insecure Mode Activation: The method for enabling insecure mode has been updated from a boolean CURL_INSECURE variable to a simpler presence check of the INSECURE environment variable.
- Comprehensive Documentation Updates: All README files (English, Simplified Chinese, Traditional Chinese) have been revised to accurately reflect the new INSECURE variable usage, including new example commands.
- Refactored SSL Verification Logic: The install.sh script now dynamically sets the curl --insecure argument based on the INSECURE variable's presence, removing previous validation and explicit CURL_INSECURE checks.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments or fill out our survey to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request correctly changes the insecure mode activation from a CURL_INSECURE boolean-like variable to checking for the presence of the INSECURE environment variable. The documentation in all languages has been updated accordingly. My review focuses on improving the robustness of the shell script by using an array for optional curl arguments, which is a safer practice.
| @@ -66,7 +66,7 @@ function download_and_install() { | |||
| # Use temp dir for download | |||
| TARGET="${TMPDIR}/${CLIENT_BINARY}" | |||
|
|
|||
| curl -# -fSL --retry 5 --keepalive-time 2 ${INSECURE_OPTION} "${DOWNLOAD_URL_PREFIX}/${CLIENT_BINARY}" -o "${TARGET}" | |||
| curl -# -fSL --retry 5 --keepalive-time 2 ${INSECURE_ARG} "${DOWNLOAD_URL_PREFIX}/${CLIENT_BINARY}" -o "${TARGET}" | |||
There was a problem hiding this comment.
As part of refactoring to use an array for optional arguments, please update this curl invocation. Using "${INSECURE_ARGS[@]}" ensures arguments are handled safely.
| curl -# -fSL --retry 5 --keepalive-time 2 ${INSECURE_ARG} "${DOWNLOAD_URL_PREFIX}/${CLIENT_BINARY}" -o "${TARGET}" | |
| curl -# -fSL --retry 5 --keepalive-time 2 "${INSECURE_ARGS[@]}" "${DOWNLOAD_URL_PREFIX}/${CLIENT_BINARY}" -o "${TARGET}" |
| @@ -104,9 +104,9 @@ | |||
| function get_latest_version() { | |||
| local latest | |||
| if command -v jq >/dev/null 2>&1; then | |||
| latest=$(curl $INSECURE_OPTION -# --retry 5 -fSL https://api.github.com/repos/appleboy/CodeGPT/releases/latest | jq -r .tag_name) | |||
| latest=$(curl $INSECURE_ARG -# --retry 5 -fSL https://api.github.com/repos/appleboy/CodeGPT/releases/latest | jq -r .tag_name) | |||
There was a problem hiding this comment.
As part of refactoring to use an array for optional arguments, please update this curl invocation. Using "${INSECURE_ARGS[@]}" ensures arguments are handled safely.
| latest=$(curl $INSECURE_ARG -# --retry 5 -fSL https://api.github.com/repos/appleboy/CodeGPT/releases/latest | jq -r .tag_name) | |
| latest=$(curl "${INSECURE_ARGS[@]}" -# --retry 5 -fSL https://api.github.com/repos/appleboy/CodeGPT/releases/latest | jq -r .tag_name) |
| else | ||
| latest=$(curl $INSECURE_OPTION -# --retry 5 -fSL https://api.github.com/repos/appleboy/CodeGPT/releases/latest | grep '"tag_name":' | sed -E 's/.*"tag_name": ?"v?([^"]+)".*/\1/') | ||
| latest=$(curl $INSECURE_ARG -# --retry 5 -fSL https://api.github.com/repos/appleboy/CodeGPT/releases/latest | grep '"tag_name":' | sed -E 's/.*"tag_name": ?"v?([^"]+)".*/\1/') |
There was a problem hiding this comment.
As part of refactoring to use an array for optional arguments, please update this curl invocation. Using "${INSECURE_ARGS[@]}" ensures arguments are handled safely.
| latest=$(curl $INSECURE_ARG -# --retry 5 -fSL https://api.github.com/repos/appleboy/CodeGPT/releases/latest | grep '"tag_name":' | sed -E 's/.*"tag_name": ?"v?([^"]+)".*/\1/') | |
| latest=$(curl "${INSECURE_ARGS[@]}" -# --retry 5 -fSL https://api.github.com/repos/appleboy/CodeGPT/releases/latest | grep '"tag_name":' | sed -E 's/.*"tag_name": ?"v?([^"]+)".*/\1/') |
| INSECURE_ARG="" | ||
| if [[ -n "${INSECURE:-}" ]]; then | ||
| INSECURE_ARG="--insecure" | ||
| print_message warning "WARNING: INSECURE mode is enabled. Proceeding with insecure download." | ||
| print_message warning "WARNING: You are bypassing SSL certificate verification. This is insecure and may expose you to man-in-the-middle attacks." | ||
| fi |
There was a problem hiding this comment.
For better script robustness, it's recommended to use an array to handle optional command arguments. This avoids potential word-splitting issues and is generally safer. This refactoring defines INSECURE_ARGS as an array, which will be empty by default and contain --insecure when needed.
I'll add suggestions to update the curl calls accordingly.
| INSECURE_ARG="" | |
| if [[ -n "${INSECURE:-}" ]]; then | |
| INSECURE_ARG="--insecure" | |
| print_message warning "WARNING: INSECURE mode is enabled. Proceeding with insecure download." | |
| print_message warning "WARNING: You are bypassing SSL certificate verification. This is insecure and may expose you to man-in-the-middle attacks." | |
| fi | |
| if [[ -n "${INSECURE:-}" ]]; then | |
| INSECURE_ARGS=('--insecure') | |
| print_message warning "WARNING: INSECURE mode is enabled. Proceeding with insecure download." | |
| print_message warning "WARNING: You are bypassing SSL certificate verification. This is insecure and may expose you to man-in-the-middle attacks." | |
| else | |
| INSECURE_ARGS=() | |
| fi |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
README.zh-tw.md (1)
141-143: Good usage exampleExample accurately shows enabling insecure mode with INSECURE=1.
Consider adding a short caution note below the example to discourage routine use:
# 注意：啟用 insecure 僅建議用於除錯或臨時情境。此操作會略過 SSL 憑證驗證，可能導致中間人攻擊風險。README.zh-cn.md (1)
137-139: 示例正确直观展示 INSECURE=1 的用法清晰。
建议在示例下添加一行安全提示，避免日常使用：
# 注意：仅在调试或临时场景启用 insecure。该操作会跳过 SSL 证书校验，存在中间人攻击风险。README.md (1)
142-144: Example usage is correctAccurately demonstrates enabling insecure mode.
Add a brief warning below to set expectations:
Warning: Enable insecure mode only for troubleshooting. It disables SSL certificate verification and may expose you to MITM attacks.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
README.md(1 hunks)README.zh-cn.md(1 hunks)README.zh-tw.md(1 hunks)install.sh(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Analyze (go)
🔇 Additional comments (5)
README.zh-tw.md (1)
134-137: INSECURE env var doc looks goodClear explanation that any value enables insecure mode. Matches script behavior.
README.zh-cn.md (1)
130-133: INSECURE 变量说明准确“只要设置该变量（值不限）即跳过 SSL 验证”的描述与脚本一致。
README.md (1)
133-138: Env var table updated correctlyWording is clear that presence of INSECURE skips SSL verification.
install.sh (2)
69-69: Good: curl download respects INSECURE_ARGSwitching to ${INSECURE_ARG} is correct and safe when unset.
107-110: Good: GitHub API calls also respect INSECURE_ARGBoth jq and grep branches align with new behavior.
| # If INSECURE is set to any value, enable curl --insecure | ||
| INSECURE_ARG="" | ||
| if [[ -n "${INSECURE:-}" ]]; then | ||
| INSECURE_ARG="--insecure" | ||
| print_message warning "WARNING: INSECURE mode is enabled. Proceeding with insecure download." | ||
| print_message warning "WARNING: You are bypassing SSL certificate verification. This is insecure and may expose you to man-in-the-middle attacks." | ||
| fi |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Enable backward compatibility with deprecated CURL_INSECURE (optional)
Current behavior is correct per PR goals. To avoid breaking existing automation, optionally honor legacy CURL_INSECURE (any non-empty), and emit a deprecation warning.
INSECURE_ARG=""
if [[ -n "${INSECURE:-}" ]]; then
INSECURE_ARG="--insecure"
print_message warning "WARNING: INSECURE mode is enabled. Proceeding with insecure download."
print_message warning "WARNING: You are bypassing SSL certificate verification. This is insecure and may expose you to man-in-the-middle attacks."
fi
+
+# Backward compatibility (deprecated). Prefer INSECURE=1.
+if [[ -z "${INSECURE:-}" && -n "${CURL_INSECURE:-}" ]]; then
+ INSECURE_ARG="--insecure"
+ print_message warning "WARNING: CURL_INSECURE is deprecated. Use INSECURE=1 instead."
+fiTo ensure all old references were removed elsewhere in the repo and that curl call sites now use INSECURE_ARG, run:
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Searching for legacy CURL_INSECURE..."
rg -n --hidden --glob '!*dist*' --glob '!*build*' --glob '!*node_modules*' 'CURL_INSECURE' || true
echo "Searching for curl sites using INSECURE_ARG..."
rg -n --hidden --glob '!*dist*' --glob '!*build*' --glob '!*node_modules*' 'curl .*INSECURE_ARG'Length of output: 876
Honor legacy CURL_INSECURE for backward compatibility
All curl invocations in install.sh already use ${INSECURE_ARG} and there are no other references to CURL_INSECURE in the repo. You can safely add the following block immediately after the existing INSECURE check to optionally support the deprecated variable and emit a deprecation warning:
INSECURE_ARG=""
if [[ -n "${INSECURE:-}" ]]; then
INSECURE_ARG="--insecure"
print_message warning "WARNING: INSECURE mode is enabled. Proceeding with insecure download."
print_message warning "WARNING: You are bypassing SSL certificate verification. This is insecure and may expose you to man-in-the-middle attacks."
fi
+# Backward compatibility (deprecated). Prefer INSECURE=1.
+if [[ -z "${INSECURE:-}" && -n "${CURL_INSECURE:-}" ]]; then
+ INSECURE_ARG="--insecure"
+ print_message warning "WARNING: CURL_INSECURE is deprecated. Use INSECURE=1 instead."
+fiThis ensures any existing automation relying on CURL_INSECURE continues to work while guiding users toward the new INSECURE flag.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # If INSECURE is set to any value, enable curl --insecure | |
| INSECURE_ARG="" | |
| if [[ -n "${INSECURE:-}" ]]; then | |
| INSECURE_ARG="--insecure" | |
| print_message warning "WARNING: INSECURE mode is enabled. Proceeding with insecure download." | |
| print_message warning "WARNING: You are bypassing SSL certificate verification. This is insecure and may expose you to man-in-the-middle attacks." | |
| fi | |
| # If INSECURE is set to any value, enable curl --insecure | |
| INSECURE_ARG="" | |
| if [[ -n "${INSECURE:-}" ]]; then | |
| INSECURE_ARG="--insecure" | |
| print_message warning "WARNING: INSECURE mode is enabled. Proceeding with insecure download." | |
| print_message warning "WARNING: You are bypassing SSL certificate verification. This is insecure and may expose you to man-in-the-middle attacks." | |
| fi | |
| # Backward compatibility (deprecated). Prefer INSECURE=1. | |
| if [[ -z "${INSECURE:-}" && -n "${CURL_INSECURE:-}" ]]; then | |
| INSECURE_ARG="--insecure" | |
| print_message warning "WARNING: CURL_INSECURE is deprecated. Use INSECURE=1 instead." | |
| fi |
🤖 Prompt for AI Agents
In install.sh around lines 123 to 129, add a check for the legacy CURL_INSECURE
environment variable immediately after the existing INSECURE check. If
CURL_INSECURE is set, assign "--insecure" to INSECURE_ARG and print a
deprecation warning message advising users to switch to the INSECURE variable.
This maintains backward compatibility while guiding users to update their usage.
Summary by CodeRabbit
Documentation
CURL_INSECUREenvironment variable withINSECUREacross all language versions of the README.INSECUREto any value will skip SSL verification during installation.Chores