Merge pull request #18800 from Homebrew/ca-certs-secure

revert setting `--insecure` to download ca-certificates

Library/Homebrew/cmd/vendor-install.sh

@@ -1,8 +1,11 @@
 # Documentation defined in Library/Homebrew/cmd/vendor-install.rb
 
-# HOMEBREW_CURLRC, HOMEBREW_LIBRARY is from the user environment
-# HOMEBREW_CACHE, HOMEBREW_CURL, HOMEBREW_LINUX, HOMEBREW_LINUX_MINIMUM_GLIBC_VERSION, HOMEBREW_MACOS,
-# HOMEBREW_MACOS_VERSION_NUMERIC and HOMEBREW_PROCESSOR are set by brew.sh
+# HOMEBREW_ARTIFACT_DOMAIN, HOMEBREW_ARTIFACT_DOMAIN_NO_FALLBACK, HOMEBREW_BOTTLE_DOMAIN, HOMEBREW_CACHE,
+# HOMEBREW_CURLRC, HOMEBREW_DEVELOPER, HOMEBREW_DEBUG, HOMEBREW_VERBOSE are from the user environment
+# HOMEBREW_PORTABLE_RUBY_VERSION is set by utils/ruby.sh
+# HOMEBREW_LIBRARY, HOMEBREW_PREFIX are set by bin/brew
+# HOMEBREW_CURL, HOMEBREW_GITHUB_PACKAGES_AUTH, HOMEBREW_LINUX, HOMEBREW_LINUX_MINIMUM_GLIBC_VERSION, HOMEBREW_MACOS,
+# HOMEBREW_PHYSICAL_PROCESSOR, HOMEBREW_PROCESSOR, HOMEBREW_USER_AGENT_CURL are set by brew.sh
 # shellcheck disable=SC2154
 source "${HOMEBREW_LIBRARY}/Homebrew/utils/lock.sh"
 source "${HOMEBREW_LIBRARY}/Homebrew/utils/ruby.sh"
@@ -129,11 +132,6 @@ fetch() {
     curl_args[${#curl_args[*]}]="--progress-bar"
   fi
 
-  if [[ "${HOMEBREW_MACOS_VERSION_NUMERIC}" -lt "100600" ]]
-  then
-    curl_args[${#curl_args[*]}]="--insecure"
-  fi
-
   temporary_path="${CACHED_LOCATION}.incomplete"
 
   mkdir -p "${HOMEBREW_CACHE}"

Library/Homebrew/download_strategy.rb

@@ -559,14 +559,6 @@ class CurlDownloadStrategy < AbstractFileDownloadStrategy
 
     args += meta.fetch(:headers, []).flat_map { |h| ["--header", h.strip] }
 
-    if meta[:insecure]
-      unless @insecure_warning_shown
-        opoo DevelopmentTools.insecure_download_warning("an updated certificates file")
-        @insecure_warning_shown = true
-      end
-      args += ["--insecure"]
-    end
-
     args
   end
 

Library/Homebrew/resource.rb

@@ -51,20 +51,6 @@ class Resource
   def owner=(owner)
     @owner = owner
     patches.each { |p| p.owner = owner }
-
-    return if !owner.respond_to?(:full_name) || owner.full_name != "ca-certificates"
-    return if Homebrew::EnvConfig.no_insecure_redirect?
-
-    @insecure = !specs[:bottle] && (DevelopmentTools.ca_file_substitution_required? ||
-                                    DevelopmentTools.curl_substitution_required?)
-    return if @url.nil?
-
-    specs = if @insecure
-      @url.specs.merge({ insecure: true })
-    else
-      @url.specs.except(:insecure)
-    end
-    @url = URL.new(@url.to_s, specs)
   end
 
   # Removes /s from resource names; this allows Go package names