Refusing it unconditionally was security theatre: --insecure also sets
InsecureSkipVerify, so an attacker in position to intercept can already
serve anything over the https leg with a self-signed certificate. It also
broke an internal server that redirects and works today.
--insecure now means one thing everywhere: the transport guarantees are
waived.
The scheme was only checked on the URL the user wrote. A server answering
an https URL with a redirect to http was followed by the client without
any further check, so both the HEAD probe and the download travelled in
the clear, and a network attacker could substitute the Taskfile that is
about to be executed.
CheckRedirect now refuses an https to http hop. --insecure does not
loosen it: requesting an http entrypoint is the user's decision, being
sent to one is the server's. Setting CheckRedirect also replaces Go's
default cap, so the ten-hop limit is kept explicitly.
The three call sites turned almost every client error into a generic
download failure, which would have hidden the reason; TaskfileNotSecureError
is now passed through, with wording of its own for the redirect case since
--insecure is not a way out of it.
* feat: remote taskfiles over http
* feat: allow insecure connections when --insecure flag is provided
* feat: better error handling for fetch errors
* fix: ensure cache directory always exists
* fix: setup logger before everything else
* feat: put remote taskfiles behind an experiment
* feat: --download and --offline flags for remote taskfiles
* feat: node.Read accepts a context
* feat: experiment docs
* chore: changelog
* chore: remove unused optional param from Node interface
* chore: tidy up and generalise NewNode function
* fix: use sha256 in remote checksum
* feat: --download by itself will not run a task
* feat: custom error if remote taskfiles experiment is not enabled
* refactor: BaseNode functional options and simplified FileNode
* fix: use hex encoding for checksum instead of b64
