fix(remote): allow a downgrade redirect under --insecure

Refusing it unconditionally was security theatre: --insecure also sets
InsecureSkipVerify, so an attacker in position to intercept can already
serve anything over the https leg with a self-signed certificate. It also
broke an internal server that redirects and works today.

--insecure now means one thing everywhere: the transport guarantees are
waived.
This commit is contained in:
Valentin Maerten
2026-08-23 13:28:20 +02:00
parent f1637f84b5
commit dfc530e97e
5 changed files with 77 additions and 37 deletions

View File

@@ -110,7 +110,7 @@ type TaskfileNotSecureError struct {
func (err *TaskfileNotSecureError) Error() string {
if err.Redirect {
return fmt.Sprintf(
`task: Taskfile %q was redirected to over an insecure connection. Point the URL at the final location instead`,
`task: Taskfile %q was redirected to over an insecure connection. You can override this by using the --insecure flag`,
filepath.ToSlash(err.URI),
)
}