Re: [PATCH v2 1/1] configure.ac: disable NTLM by default as it's insecure

Can anyone review this please?


> On Mar 8, 2026, at 6:54=E2=80=AFPM, Philip Prindeville =
<[email protected]> wrote:
>=20
> From: Philip Prindeville <[email protected]>
>=20
> Copyright-paperwork-exempt: Yes
> ---
> .gitlab-ci.yml | 20 +++++++++++++++-----
> configure.ac   |  4 ++--
> 2 files changed, 17 insertions(+), 7 deletions(-)
>=20
> diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
> index =
c764e2dbf366f5d9b2f01eca2f8ec5eadaf28344..ec8a340eb5278ec88bc4f9a728657956=
c1e373bc 100644
> --- a/.gitlab-ci.yml
> +++ b/.gitlab-ci.yml
> @@ -96,6 +96,7 @@ Valgrind:
>         - tar xvf wget-*.gz
>         - cd wget-*/
>         - ./configure $CONFIGURE_BASE_FLAGS --cache-file =
../cache/config.cache
> +          --enable-ntlm
>         - make check-valgrind
>     except:
>         - coverity-scan@gnuwget/wget
> @@ -149,6 +150,7 @@ Debian-OldStable:
>         - tar xvf wget-*.gz
>         - cd wget-*/
>         - ./configure $CONFIGURE_BASE_FLAGS --cache-file =
../cache/config.cache
> +          --enable-ntlm
>         - make
>         - make -j$(nproc) check
>     except:
> @@ -175,6 +177,7 @@ Debian-Stable:
>         - tar xvf wget-*.gz
>         - cd wget-*/
>         - ./configure $CONFIGURE_BASE_FLAGS --cache-file =
../cache/config.cache
> +          --enable-ntlm
>         - make -j$(nproc) check
>     except:
>         - coverity-scan@gnuwget/wget
> @@ -200,6 +203,7 @@ CentOS-OldLTS:
>         - tar xvf wget-*.gz
>         - cd wget-*/
>         - ./configure $CONFIGURE_BASE_FLAGS --cache-file =
../cache/config.cache
> +          --enable-ntlm
>         - make -j$(nproc)
>         - make -j$(nproc) check
>     except:
> @@ -229,7 +233,8 @@ TLS/OpenSSL:
>         - cd wget-*/
>         - echo "127.0.0.1 wgettestingserver" >>/etc/hosts
>         - cat /etc/hosts
> -        - ./configure $CONFIGURE_BASE_FLAGS --cache-file =
../cache/config.cache --with-ssl=3Dopenssl
> +        - ./configure $CONFIGURE_BASE_FLAGS --cache-file =
../cache/config.cache
> +          --with-ssl=3Dopenssl --enable-ntlm
>         - make -j$(nproc)
>         - make -j$(nproc) check-valgrind
>     except:
> @@ -257,7 +262,8 @@ TLS/GnuTLS:
>         - cd wget-*/
>         - echo "127.0.0.1 wgettestingserver" >>/etc/hosts
>         - cat /etc/hosts
> -        - ./configure $CONFIGURE_BASE_FLAGS --cache-file =
../cache/config.cache --with-ssl=3Dgnutls
> +        - ./configure $CONFIGURE_BASE_FLAGS --cache-file =
../cache/config.cache
> +          --with-ssl=3Dgnutls --enable-ntlm
>         - make -j$(nproc)
>         - make -j$(nproc) check-valgrind
>     except:
> @@ -290,7 +296,8 @@ Sanitizers:
>         - export ASAN_SYMBOLIZER_PATH=3D/usr/bin/llvm-symbolizer
> #       - export =
LSAN_OPTIONS=3Dsuppressions=3D"$PWD/tests/clang-asan-suppressions"
>         - ./configure $CONFIGURE_BASE_FLAGS --cache-file =
../cache/config.cache
> -            --enable-fsanitize-asan --enable-fsanitize-ubsan
> +          --enable-fsanitize-asan --enable-fsanitize-ubsan
> +          --enable-ntlm
>         - make -j$(nproc) check
>     except:
>         - coverity-scan@gnuwget/wget
> @@ -316,6 +323,7 @@ Scan-Build:
>         - tar xvf wget-*.gz
>         - cd wget-*/
>         - scan-build ./configure $CONFIGURE_BASE_FLAGS --cache-file =
../cache/config.cache
> +          --enable-ntlm
>         - make -C lib -j$(nproc)
>         - make -C src css_.o
>         - scan-build -v -enable-checker nullability --keep-empty =
--status-bugs -o ../scan-build make -j$(nproc)
> @@ -343,6 +351,7 @@ CoverageReports:
>         - tar xvf wget-*.gz
>         - cd wget-*/
>         - ./configure $CONFIGURE_BASE_FLAGS --cache-file =
../cache/config.cache
> +         --enable-ntlm
>         - make -j$(nproc) check-coverage
>         - mv lcov ../test-coverage
>         - make -C doc html
> @@ -377,6 +386,7 @@ MinGW64:
>         - echo "WINEPATH=3D$WINEPATH"
>         - LIBS=3D"-ldl -lpsapi" ./configure $CONFIGURE_BASE_FLAGS =
--cache-file ../cache/config.cache
>             --build=3Dx86_64-pc-linux-gnu --host=3D$PREFIX =
--enable-shared
> +            --enable-ntlm
>         - make -j$(nproc)
>         - cp -p src/wget.exe src/wget
>         - make check -j$(nproc) LOG_COMPILER=3Dwine
> @@ -407,7 +417,7 @@ ArchLinux:
>         - ./bootstrap
>         - autoreconf -fi
>         - touch .manywarnings
> -        - ./configure $CONFIGURE_BASE_FLAGS
> +        - ./configure $CONFIGURE_BASE_FLAGS --enable-ntlm
>         - make -j$(nproc)
>         - make check -j$(nproc)
>     except:
> @@ -431,7 +441,7 @@ Fedora:
>         - ./bootstrap
>         - autoreconf -fi
>         - touch .manywarnings
> -        - ./configure $CONFIGURE_BASE_FLAGS
> +        - ./configure $CONFIGURE_BASE_FLAGS --enable-ntlm
>         - make -j$(nproc) check
>     except:
>         - coverity-scan@gnuwget/wget
> diff --git a/configure.ac b/configure.ac
> index =
5f6a7286ca8782d791a821c3c90872a9f8ae8646..6ce2e43f59ac744f96054cca21dcf9ad=
8277b943 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -188,9 +188,9 @@ AS_IF([test "x$ENABLE_DIGEST" =3D xyes],
>=20
> dnl NTLM: Support for HTTP NTLM Authentication
> AC_ARG_ENABLE([ntlm],
> -  [AS_HELP_STRING([--disable-ntlm], [disable support for NTLM =
authorization])],
> +  [AS_HELP_STRING([--enable-ntlm], [enable support for NTLM =
authorization])],
>   [ENABLE_NTLM=3D$enableval],
> -  [ENABLE_NTLM=3Dauto]
> +  [ENABLE_NTLM=3Dno]
> )
>=20
>=20
> --=20
> 2.43.0
>=20