Repo Certificate Authority field for private repos

[stefanha]

Public repos pass certificate verification using the system's trusted root certificates. Private repos may require a Certificate Authority that is not in the system's trusted root certificates.

Although some users may be able to add CAs system-wide, it is easiest and cleanest to allow setting CAs on a per-repo basis. This way no change system-wide change is necessary in order to use private repos with custom CAs.

The repo.yaml syntax can be extended with a CA string field so users can provide the CA together with the repository information.

@andreabolognani

[rmohr]

If I understand this correctly, we would basically allow setting a CA field in repo.yaml, and then create a custom https client which will only talk to a repo serving a cert form there. Correct?

[stefanha]

Yes, the HTTPS client would use the repo.yaml's CA for certificate verification. I'm not sure whether the client should exclusively use the CA or the CA is used in addition to the system-wide trusted root certificates.

This way, a private repo that is available via HTTPS with an internal CA will work.