HTTPS file sources with non-puppet-trusted certs can't be used

In PUP-1072 we added support for http and https URL schemes for file resources' source attributes:

file { '/tmp/myfile':

  source => 'https://myserver/myfile'

}

UPDATED

1. The above works provided the CA certificate that issued the server's certificate is in the CA bundle distributed in puppet-agent packages. There are workarounds to add certificates to puppet's cert bundle, but those workarounds are lost when the puppet-agent package is updated.

2. As of Puppet 6.15.0 puppet will trust the puppet CA in addition to puppet's CA bundle when retrieving file metadata and content via https file sources. So the issue chuck described with source => "https://${server_facts['servername']}:8140//puppet-ca/v1/certificate/ca?environment=production" will be resolved.

3. This ticket is about a) creating a puppet setting referring to a directory or file containing system CA certs, and b) modifying the Puppet::SSL::SSLProvider#create_system_context method so that the system CA certs are added to the X509 store via OpenSSL::X509::Store#add_path (for a directory) or OpenSSL::X509::Store#add_file (for a file).

Original

Somehow we failed to realize that the implementation of this feature requires that the remote webserver present a certificate that is trusted by the puppet agent's SSL configuration. In practice this is extremely unlikely and difficult to configure, and therefore the utility of this feature is pretty limited.

In the code, this is because the request ultimately uses the same routines (in Puppet::Util::HttpProxy.get_http_object) that the agent itself uses, where the SSL verification mode is hardcoded but the certificate store is not.

There should be some way to permit retrieval of these files. A couple of options that occured to me as I was tracing this down:

1. make the ssl verification mode configurable or disabled by default for file-source retrieval (equivalent to curl -k)
2. use the system-wide trust store instead of puppet's store
3. expose the certificate trust and verification mode as parameters on the file type (this is truly awful)

... surely someone else has better ideas ...