Refusing it unconditionally was security theatre: --insecure also sets
InsecureSkipVerify, so an attacker in position to intercept can already
serve anything over the https leg with a self-signed certificate. It also
broke an internal server that redirects and works today.
--insecure now means one thing everywhere: the transport guarantees are
waived.
The scheme was only checked on the URL the user wrote. A server answering
an https URL with a redirect to http was followed by the client without
any further check, so both the HEAD probe and the download travelled in
the clear, and a network attacker could substitute the Taskfile that is
about to be executed.
CheckRedirect now refuses an https to http hop. --insecure does not
loosen it: requesting an http entrypoint is the user's decision, being
sent to one is the server's. Setting CheckRedirect also replaces Go's
default cap, so the ten-hop limit is kept explicitly.
The three call sites turned almost every client error into a generic
download failure, which would have hidden the reason; TaskfileNotSecureError
is now passed through, with wording of its own for the redirect case since
--insecure is not a way out of it.
Previously if a task was run as a dependency of another task,
the error message simply reported something like:
exit status 1
It is desirable instead to name the root task and all child tasks in the tree
to the failing task.
After this PR, the error message will read:
task: Failed to run task "root": task: Failed to run task "failing-task": exit status 1
* refactor: moved/simplified snippets into its own file with tests
* refactor: move snippet to taskfile package
* feat: support snippets with line/col = 0
* feat: functional options for snippets
* feat: added option to hide snippet indicators
* feat: store raw lines for length calculations
* feat: add debug function for TaskfileDecodeError
* fix: decode errors from commands
* fix: schema for defer cmd calls
* fix: linting issues
* refactor: split var and vars into different files like other structures
* feat: remote taskfiles over http
* feat: allow insecure connections when --insecure flag is provided
* feat: better error handling for fetch errors
* fix: ensure cache directory always exists
* fix: setup logger before everything else
* feat: put remote taskfiles behind an experiment
* feat: --download and --offline flags for remote taskfiles
* feat: node.Read accepts a context
* feat: experiment docs
* chore: changelog
* chore: remove unused optional param from Node interface
* chore: tidy up and generalise NewNode function
* fix: use sha256 in remote checksum
* feat: --download by itself will not run a task
* feat: custom error if remote taskfiles experiment is not enabled
* refactor: BaseNode functional options and simplified FileNode
* fix: use hex encoding for checksum instead of b64
