Check that https-get-expired is still up to date

intrigeri
2026-04-06T12:44:57Z

[[_TOC_]]

# Context

`https-get-expired` is our own tool that can perform HTTPS requests accepting certificates that are expired. To do this, we are overriding the default Golang function `verifyServerCertificate` with another one that ...

Context

What you need to do

Recurse

Meta

Context

https-get-expired is our own tool that can perform HTTPS requests accepting certificates that are expired. To do this, we are overriding the default Golang function verifyServerCertificate with another one that is largely copied, but with small differences.

What you need to do

To make sure we keep this updated to changes in Golang, check https://gitlab.tails.boum.org/tails/tails/-/blob/stable/config/chroot_local-includes/usr/src/https-get-expired.go; the code has comments which will tell you where the original is.

Check that the Golang code has not changed recently in the current version we are shipping. To do so, check if if the relevant golang-$VERSION package that we use during the build (in config/chroot_local-hooks/52-https-accept-expired, so in a chroot of the Debian version Tails is based on) was updated since last time we checked. For example, for Tails 6.x, check if https://tracker.debian.org/pkg/golang-1.19 was updated in Bookworm (including security & updates).

If there have been changes, create a new issue to track the next step, which is: ensure we minimize the delta between that code and ours.

Also check if our code also works for future versions of Go.

Recurse

check the code

recurse

update the Roadmap:YYYYQX label

set an adequate milestone, if it exists already; else remove the obsolete milestone

set the due date appropriately

Meta

It's OK to skip one such quarterly check, but not 2 in a row.