fix(installer): honor unsecured certificate flag in installer download steps (#3924) - #218
Open
Samuel Hassine (SamuelHassine) wants to merge 1 commit into
Open
fix(installer): honor unsecured certificate flag in installer download steps (#3924)#218Samuel Hassine (SamuelHassine) wants to merge 1 commit into
Samuel Hassine (SamuelHassine) wants to merge 1 commit into
Conversation
…d steps (#3924)
When the OpenAEV platform runs with a self-signed certificate, the
installer and upgrade scripts failed at the download step: the platform
substitutes ${OPENAEV_UNSECURED_CERTIFICATE} into the script templates,
but the download commands (curl on Linux/macOS, Invoke-WebRequest on
Windows) always enforced TLS certificate validation.
- Linux/macOS (12 scripts): add "-k" to the platform download curl
commands only when the substituted flag is "true".
- Windows (6 scripts): when the flag is "true", set
[System.Net.ServicePointManager]::ServerCertificateValidationCallback
around the download and restore the previous callback afterwards.
This works on PowerShell 5.1, which does not support
Invoke-WebRequest -SkipCertificateCheck (PS 6+ only).
TLS validation is bypassed only when the administrator explicitly
enabled the unsecured certificate flag on the platform; the default
path is unchanged.
Fixes OpenAEV-Platform/openaev#3924
Copilot started reviewing on behalf of
Samuel Hassine (SamuelHassine)
August 11, 2026 12:55
View session
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the agent installer/upgrade script templates to honor the platform’s OPENAEV_UNSECURED_CERTIFICATE flag during download steps, allowing installation/upgrade to work when the platform is served with a self-signed (untrusted) TLS certificate.
Changes:
- Linux/macOS: introduce a
curl_insecureflag (-konly when the substituted flag is"true") and pass it to platform downloadcurlcalls. - Windows: when the substituted flag is
"true", temporarily overrideServicePointManager.ServerCertificateValidationCallbackto accept all certificates during download, then restore the previous callback.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| installer/windows/agent-upgrade.ps1 | Temporarily disables TLS validation based on substituted flag for upgrade downloads. |
| installer/windows/agent-upgrade-session-user.ps1 | Same TLS-validation override pattern for session-user upgrade flow. |
| installer/windows/agent-upgrade-service-user.ps1 | Same TLS-validation override pattern for service-user upgrade flow. |
| installer/windows/agent-installer.ps1 | Wraps installer download with conditional TLS-validation bypass and restores in finally. |
| installer/windows/agent-installer-session-user.ps1 | Same conditional TLS bypass for session-user installer download and restore in finally. |
| installer/windows/agent-installer-service-user.ps1 | Same conditional TLS bypass for service-user installer download and restore in finally. |
| installer/macos/agent-upgrade.sh | Adds conditional curl -k usage for upgrade downloads and migration installer download. |
| installer/macos/agent-upgrade-session-user.sh | Adds conditional curl -k usage for session-user upgrade downloads and migration installer download. |
| installer/macos/agent-upgrade-service-user.sh | Adds conditional curl -k usage for service-user upgrade download. |
| installer/macos/agent-installer.sh | Adds conditional curl -k usage for installer download. |
| installer/macos/agent-installer-session-user.sh | Adds conditional curl -k usage for session-user installer download. |
| installer/macos/agent-installer-service-user.sh | Adds conditional curl -k usage for service-user installer download. |
| installer/linux/agent-upgrade.sh | Adds conditional curl -k usage for upgrade downloads and migration installer download. |
| installer/linux/agent-upgrade-session-user.sh | Adds conditional curl -k usage for session-user upgrade downloads and migration installer download. |
| installer/linux/agent-upgrade-service-user.sh | Adds conditional curl -k usage for service-user upgrade download. |
| installer/linux/agent-installer.sh | Adds conditional curl -k usage for installer download. |
| installer/linux/agent-installer-session-user.sh | Adds conditional curl -k usage for session-user installer download. |
| installer/linux/agent-installer-service-user.sh | Adds conditional curl -k usage for service-user installer download. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
51
to
+62
| Invoke-WebRequest -Uri "${OPENAEV_URL}/api/tenants/${OPENAEV_TENANT_ID}/agent/executable/openaev/windows/${architecture}" -OutFile $AgentUpgradedPath; | ||
|
|
||
| sc.exe stop $AgentName; | ||
|
|
||
| Remove-Item -Force $AgentPath; | ||
| Move-Item $AgentUpgradedPath $AgentPath; | ||
|
|
||
| sc.exe start $AgentName; | ||
| sc.exe start $AgentName; | ||
|
|
||
| if ("${OPENAEV_UNSECURED_CERTIFICATE}" -eq "true") { | ||
| [System.Net.ServicePointManager]::ServerCertificateValidationCallback = $previousCertificateValidationCallback | ||
| } |
Comment on lines
+2
to
+7
| if ("${OPENAEV_UNSECURED_CERTIFICATE}" -eq "true") { | ||
| # Skip TLS certificate validation: the platform explicitly runs with an | ||
| # unsecured (e.g. self-signed) certificate (PowerShell 5.1 compatible) | ||
| $previousCertificateValidationCallback = [System.Net.ServicePointManager]::ServerCertificateValidationCallback | ||
| [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true } | ||
| } |
Comment on lines
+2
to
+7
| if ("${OPENAEV_UNSECURED_CERTIFICATE}" -eq "true") { | ||
| # Skip TLS certificate validation: the platform explicitly runs with an | ||
| # unsecured (e.g. self-signed) certificate (PowerShell 5.1 compatible) | ||
| $previousCertificateValidationCallback = [System.Net.ServicePointManager]::ServerCertificateValidationCallback | ||
| [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When the OpenAEV platform runs with a self-signed certificate, agent installation fails before the agent is even installed: the installer download step always enforces TLS certificate validation, even though the administrator explicitly enabled the platform's unsecured certificate flag. The platform already substitutes
${OPENAEV_UNSECURED_CERTIFICATE}(literaltrue/false) into these script templates for the agent's own config - this PR makes the download commands honor it too.curl_insecurevariable is set to-konly when the substituted flag istrue, and passed to every platform downloadcurl(including the OpenBAS -> OpenAEV migration paths in the upgrade scripts).true,[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }is set around the download and the previous callback is restored afterwards (infinallyfor the installers). This is PowerShell 5.1 compatible -Invoke-WebRequest -SkipCertificateCheckonly exists on PowerShell 6+.Security posture: TLS validation is bypassed ONLY when the admin explicitly set the unsecured certificate flag on the platform. With the flag
false, the scripts behave exactly as before.Note: the Caldera executor install snippet (which uses
System.Net.WebClient) lives in the platform repository frontend (InstructionSelector.tsx), not in this repository, and is not covered by this PR.Test plan
bash -npasses on all 12 modified.shscripts (POSIX syntax check).[System.Management.Automation.Language.Parser]::ParseFilereports zero errors on all 6 modified.ps1scripts.installer/windows/Run-Lint.ps1(PSScriptAnalyzer): no issues found.trueyieldscurl -sSfL -k <url>, flagfalseyields the exact previous command with no extra argument.openaev.unsecured-certificate=true, then run the generated install command on each OS; the download step should succeed. With the flagfalse, behavior must be unchanged (download fails against an untrusted certificate, as designed).Fixes OpenAEV-Platform/openaev#3924