Subject: [Rfc-markdown] kramdown-rfc and cert root stores

From: Carsten Bormann <[email-masked]>
Date: Wed, 9 Nov 2016 21:11:41 +0100

This is a sad day in so many ways.

As you know, the IETF bibxml sources are now accessible via HTTPS, which is a good thing — getting rogue citations implanted while kramdowning in Starbucks is now one thing less you need to worry about.

Unfortunately, using HTTPS requires a good store of certificate roots.  It turns out that many laptops people are installing kramdown-rfc on don’t have those, or only have ones that aren’t accessible to kramdown-rfc.  In the short time since switching to HTTPS, this has become the number one impediment to getting kramdown-rfc going.

Security is a good thing.  But getting things actually deployed tends to trump [sic] security.  So, celebrating today’s sad day in my own way, I finally gave in and added an option to 1.0.39 that suppresses certificate validation.  An environment variable

	KRAMDOWN_DONT_VERIFY_HTTPS

can be set to any value to invoke this feature, as in:

	KRAMDOWN_DONT_VERIFY_HTTPS=oops kramdown-rfc2629 foo.mkd >foo.xml

Sorry about that.

(And yes, I washed my hands between implementing this feature and typing this message.)

Grüße, Carsten