gluon-autoupdater: allow https mirror urls

[kevin-olbrich]

No description provided.

[kevin-olbrich]

Features
TLS support
Gluon now provides HTTPS client support when the tls feature is included in the site configuration, allowing nodes to establish encrypted connections to autoupdater mirrors, opkg repositories and other HTTPS servers.
Source: https://gluon.readthedocs.io/en/latest/releases/v2023.2.html

TLS support can be enabled but the site check prevents https mirror urls in site.conf.

[neocturne]

Hmm, the change is working as intended, but optimally we'd only allow HTTPS if the gluon-tls package is installed, to prevent accidentally building non-updateable firmwares (which could happen by removing the tls feature to save space, without thinking about updating the URL).

This could be implemented by having gluon-tls create a marker file like gluon-wireless-encryption-wpa3 does, and check for the existence of the marker in the site check script (similar to the check for the contents of the default_branch file).

[neocturne]

Hmm, or does libustream fall back to HTTP anyways when HTTPS is requested, but not available?

Edit: It does not fall back.

[T0biii]

maybe auto select the correct protocol if the tls feature is there or not.
if you want explicitly http:// set the URL to it. if you want http:// and/or https:// remove the prefix?
and if you have https:// set, try to fallback to http:// if all https:// mirrors are unreachable

[Djfe]

In that case https has no advantages. Just drop all packets on port 443 and nodes will fall back to port 80.
either the community offers https or it doesn't.

the bigger issue imo are root certificates that need to be replaced from time to time.
if a node is offline for atleast x years then it won't be able to update anymore, right?
unless you build self-signed certificates into the firmware that won't expire