rustup TLS warning with newer curl versions (v8.10.0+)

Verification

I searched for recent similar issues at https://github.com/rust-lang/rustup/issues?q=is%3Aissue+is%3Aopen%2Cclosed and found no duplicates.
I am on the latest version of Rustup according to https://github.com/rust-lang/rustup/tags and am still able to reproduce my issue.

Problem

Basically from what I was told by a user on the discord server, rustups check depends on the help text which has apparently changed so it doesnt see the TLS flag as a possibility. This is an issue with curl because of how it changed.

Steps

run curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
thats it you just get the following error messages when you run the script

Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure
Warning: Not enforcing TLS v1.2, this is potentially less secure

Possible Solution(s)

Though not a solution, running this before running the script appears to fix the issue

export RUSTUP_TLS_CIPHERSUITES="TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECD
SA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-A
ES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"

Notes

Apparently, the commit that caused this issue was
curl/curl@9a0cf56#diff-c7bff4c78be0ebe9d665d8a58b8794215b1b679d6e6719616e1738f1d6ca6570L53

Rustup version

Affects curl versions 8.10.0 and above

Installed toolchains

Nonapplicable, first time installing.

OS version

Alpine 8.20

@SergioSierraJr Thanks for filing this issue! Yes, we're using --help output since it's the easiest way so far to check whether a flag is supported:

rustup/rustup-init.sh

Lines 641 to 645 in a497b15

    
               _err=$(curl $_retry --proto '=https' --tlsv1.2 --ciphers "$_ciphersuites" --silent --show-error --fail --location "$1" --output "$2" 2>&1) 
        
               _status=$? 
        
           else 
        
               warn "Not enforcing strong cipher suites for TLS, this is potentially less secure" 
        
               if ! check_help_for "$3" curl --proto --tlsv1.2; then

If I understand you correctly, did you mean this filter is too narrow?

rustup/rustup-init.sh

Line 709 in a497b15

    
           if "$_cmd" --help | grep -q 'For all options use the manual or "--help all".'; then

... if so then indeed, I think '"--help all"' would suffice.

@rustbot

@rustbot claim

(scripts) Fix TLS and cipher warnings on newer curl versions

Navigation Menu

Repository navigation

rustup TLS warning with newer curl versions (v8.10.0+) #4045

Verification

Problem

Steps

Possible Solution(s)

Notes

Rustup version

Installed toolchains

OS version

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	_err=$(curl $_retry --proto '=https' --tlsv1.2 --ciphers "$_ciphersuites" --silent --show-error --fail --location "$1" --output "$2" 2>&1)
	_status=$?
	else
	warn "Not enforcing strong cipher suites for TLS, this is potentially less secure"
	if ! check_help_for "$3" curl --proto --tlsv1.2; then

rustup TLS warning with newer curl versions (v8.10.0+) #4045

Description

Verification

Problem

Steps

Possible Solution(s)

Notes

Rustup version

Installed toolchains

OS version

Activity

rami3l commented on Oct 11, 2024

rami3l commented on Oct 11, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions