Errands task manager upstream unconditionally disables TLS certificate verification for CalDAV; does this need to be addressed?

--===============3015054516388746187==
Content-Type: multipart/signed; micalg="sha-256"; protocol="application/pkcs7-signature";
	boundary="=-gFu1ThpIej7h595+8IS/"


--=-gFu1ThpIej7h595+8IS/
Content-Type: multipart/signed; micalg="pgp-sha512";
	protocol="application/pgp-signature"; boundary="=-NsKfaz/X78dUHFxh4UQx"


--=-NsKfaz/X78dUHFxh4UQx
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello,
Errands is a graphical planning and task organizer application that support=
s using CalDAV to synchronize tasks from a provider. CalDAV is a set of con=
ventions for using HTTP to access and manage calendar and task data; it's s=
imilar to what IMAP is for email. Errands is independently developed but pa=
rt of the broad GNOME Circle ecosystem.

I was browsing upstream issue reports for an unrelated reason and saw https=
://github.com/mrvladus/Errands/issues/401 which I'll crudely transcribe the=
 dialogue of below:
[2025-08-15] powerjungle (reporter): "Is there a reason TLS certificate ver=
ification is disabled by default?"

Code snippet:
> Errands/errands/lib/sync/providers/caldav.py, Line 89
> 	ssl_verify_cert=3DFalse,

Description:
> Doesn't seem like a safe approach. Why isn't there a checkbox at least fo=
r the user to choose?
> I am aware of the rewrite [then-work-in-progress rewrite of Errands in C =
instead of Python], but until then people would still be using the the curr=
ent python package in their distros.

Effectively, Errands hard-codes in its source to never attempt verification=
 of the certificate. I'm not just referring to validation here like checkin=
g a CRL or OCSP, but even name validation, so there is no authentication at=
 all and the user is not notified even when they explicitly give an https:/=
/ URL for the server. The author of Errands had this reply:
[2025-08-15] mrvladus (maintainer):
> I can't remember exactly, but I think it was breaking something so I had =
to disable that.

I find this even more concerning than the average case of a client acceptin=
g any TLS certificate whatsoever, for these reasons:
 =E2=80=A2 Errands uses HTTP Basic or Digest authentication which is common=
 for DAV clients, but it means TLS usage is absolutely essential with the p=
assword otherwise being sent in the clear.
 =E2=80=A2 The calendar and task data is quite revealing on its own; it may=
 have information about one's residence, workplace, attachments, and obliga=
tions. Unlike much groupware, a to-do list application like this is often u=
sed to record one's own thoughts or priorities with no intention of them be=
ing visible to others.

Am I overreacting? If this is an issue worthy of being fixed in Trixie, I w=
ould appreciate if someone who is better with their words and making the ri=
sks understandable why this needs to be made a priority. Above all, I'm sen=
ding this mail here to gather opinions about etiquette and to learn where t=
he bar is before making a "big deal" about something.

I'm merely an Errands user; I don't maintain the package or have a stake in=
 it otherwise.
Thanks, Debian hive mind =F0=9F=98=89

--=-NsKfaz/X78dUHFxh4UQx
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iIgEABYKADAWIQSiPzylvTnZ6xisfzWz9N0oYfTNugUCaTj58xIcanNjb3R0QHBv
c3Rlby5uZXQACgkQs/TdKGH0zbpm5gD/R4kdl+Jz+m+TARqL+VoGED0MUG4FWVfM
MNj9rqm3sggBAKIurMxp2A7FKbmvsyG809dXv0uH3hN1/P5Tv5SQtsUI
=8XSh
-----END PGP SIGNATURE-----

--=-NsKfaz/X78dUHFxh4UQx--

--=-gFu1ThpIej7h595+8IS/
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Disposition: attachment; filename="smime.p7s"
Content-Transfer-Encoding: base64

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCFFow
ggayMIIEmqADAgECAhAM4TInqCzmo9DzV8Nsth6GMA0GCSqGSIb3DQEBDQUAMHoxCzAJBgNVBAYT
AlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJzAlBgNVBAsTHkNlcnR1bSBD
ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEfMB0GA1UEAxMWQ2VydHVtIFRydXN0ZWQgUm9vdCBDQTAe
Fw0yMzA4MDEwODA5NDlaFw0zODA3MjMwODA5NDlaME4xCzAJBgNVBAYTAlBMMSEwHwYDVQQKDBhB
c3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xHDAaBgNVBAMME0NlcnR1bSBTTUlNRSBSU0EgQ0EwggIi
MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDTudxfTHvqEIhVwDB4ZDDJq+fDBq1a+nCBCTGd
nj326RGkCS2E1Q63oHTwlD9tkJt6a8UDwIIZ6eG8/OIkM/A+K2lzMrBcP9dEBdGZqCXwbqq4O4Z/
Pl8om7O7G5bwnaacpFpLGTXotg6PT/R9UWXMW+S1I5KiorBXROeFX0N+CbryUfCQj0vB5F85YXqy
HkaZdgO8YdL+j+pfUROJGLdnGff6b3+O58bBZ6f4IUVOARhyaaLQy1ofnwkV0AM2Wl/AIjA8Krwt
ROh0z5/F3k8SUyNyvIQaG0vPyctHRWLsXGbkwHo3wOpXS4KkAQR1zR+ULDGCMFhRSX/j/skJxYmA
tqbU+v56wYeLEM9LmfTCsOSrY8yNRip0PQS4FrZyi888WC49iBLzMktO+JEsmDIiAYDk9kjD9WAh
ubh8iN/5RducVz9lukfCa0+jYH7sRhpc12H3bM2ufvTbRIE5W1CRaALiGzlEWzhA3UWIBba+Y4Br
httxrrwKG9fORAubnFe0yDCnXcHC4N90YIwJ44sP0BgC9LjGR+PZNTzvSAj+qCmZ6xJOPUlssl6H
ycEPU6KsW9KnlZmETscqcC+V3ozBk8xM0VZ/AHZ34pXJcemfWG4e4rxeH0FSdwUEzj3kTA84OqRx
bb/C21XsiS1XyT3KUIGlDiIEQFgnD9Tk/PGpEwIDAQABo4IBXjCCAVowDwYDVR0TAQH/BAUwAwEB
/zAdBgNVHQ4EFgQUZvvDD770v+CcyatN3kcZvcDKpmgwHwYDVR0jBBgwFoAUjPscdbwC059OLkjZ
+WBUqsSzT/owDgYDVR0PAQH/BAQDAgEGMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAv
BgNVHR8EKDAmMCSgIqAghh5odHRwOi8vY3JsLmNlcnR1bS5wbC9jdHJjYS5jcmwwawYIKwYBBQUH
AQEEXzBdMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0uY29tMDEGCCsGAQUF
BzAChiVodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwvY3RyY2EuY2VyMDoGA1UdIAQzMDEwLwYE
VR0gADAnMCUGCCsGAQUFBwIBFhlodHRwczovL3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEB
DQUAA4ICAQACdWiFTrEXejbCNhvlQGjnGr4GwCBRRcs1+uQumSciktKucsj1mCb3tmB09bDya0be
SUDVed/h+fbPKFlON2miwRYZwdGXSFNrynzGC1oYQG3SPS6qwXS2iZe4kQ4d0pTRntGPeHRe13o5
nd3tJw/+XanUoTRy7/N2NxQ8Br16v+Ma6N2XqqLj+zXGMn8h5c0LpmqnkaMxk2hiLxXEOLFoGXXO
il3wHCkgtlZgfbgyeK/AGjqEj9XNfDCe2V4fTLsYqlb+AaVAMpXFtezeGLrsIAef+MYjXNoGKYGe
HM8AiNHeIxavk45O9Etvad/lKvPcH0hgMr9wTReCRnmjpodHgxcKG0LLI6rLR4RbEfRf3rV8xyR6
KkfjIy7W8pN/Cx/i8D/rAM46YcS281duz43X0Oaw6UjiqFwiae8DeKvTINLBR+yfJdQ/lLssNAG3
QNxXRHozNJUp/UeqUnf1WQC4NabQXKp54hWTCSBec+n550+REg/P+tDi+UsoFqiE9Mpz/I/KpA3F
GyhpDxYbLiw/e0nYLqt1HqX8F4L4sLfW346rEHtBWVNPmsQmLjI6mfhm8c4FX3jfnQowPDLvqNGJ
sO/ec397eyb8nN+8MSM1KXPVsMh4LvRZvjVL0DVEfOGBf29HWEXYuJ5llhY9/N31ay4Gsv61VgFE
7v9hQjM4ZDCCBs4wggS2oAMCAQICECVSDRtr8FpV2nzxlWEVFsgwDQYJKoZIhvcNAQELBQAwTjEL
MAkGA1UEBhMCUEwxITAfBgNVBAoMGEFzc2VjbyBEYXRhIFN5c3RlbXMgUy5BLjEcMBoGA1UEAwwT
Q2VydHVtIFNNSU1FIFJTQSBDQTAeFw0yNTA0MDUwMzQwMjZaFw0yNjA0MDUwMzQwMjVaMD4xGjAY
BgNVBAMMEWpzY290dEBwb3N0ZW8ubmV0MSAwHgYJKoZIhvcNAQkBFhFqc2NvdHRAcG9zdGVvLm5l
dDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMGCQxB2MnqxQXP08/dE2d5v78+3ucS2
UiFvb9FN0b0j/BifMZvN/9bumJzpmpVwd0d5JR9+9M/svSRf4hIBf+hLGtYJrbtte5jYEPPAlXYS
oHyNybf7ko1uJ/rHldKdvga5G6fNfThyMVb7ODDuikIDj8DFnJAi7GDuu/LD6evazvNMIwk0ii6E
1qgzf61kHw3nVp3hGs3SSm4AXj+I9ySiap7f9+h8mjqM/z2WdXfWAp07IRa5TfDhmfMjIKlIHGoO
2zf9D4i7ml12ojv/yycmjRJJnFs0Q5ic4yP5puVkC/yCjH6OMg20PaXTcPyFXhDQsmMeuAQgcD9t
V8O3IzGU4Io9gujZPJxda1yZ7BpZH7jV9xuIKbL4WoQGZSZ0dwXvzpDW9NPVeEXH2us+Xfqc6VbE
znMPPhtCqRgeqt603w87gnf7puzKBPLEoQo9VCLRx5cJPlip05TtRP4PH6uOCwK5BYs3LFSnJkg7
iJ8sTrEfbO+gEeboiO2TGplMGC/6zEcVh4yM5mPjfVkFijCZw+AavzIOlE6NHCEqKET/D7wZzAZ/
/122lLaAZ3lNS1fO9FikACxEJ9EbKZJmzphU3TGCpmobcXiDB/esYIi65In7dKy+B0XE7zDy5KZb
oKYz9o/N4u6lfUJb9Gf6kEmBJDTcyYUZZ2pJPyjwMRUvAgMBAAGjggG2MIIBsjAMBgNVHRMBAf8E
AjAAMEEGA1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9jc21pbWVyc2FjYS5jcmwuY2VydHVtLnBsL2Nz
bWltZXJzYWNhLmNybDCBgwYIKwYBBQUHAQEEdzB1MC4GCCsGAQUFBzABhiJodHRwOi8vY3NtaW1l
cnNhY2Eub2NzcC1jZXJ0dW0uY29tMEMGCCsGAQUFBzAChjdodHRwOi8vY3NtaW1lcnNhY2EucmVw
b3NpdG9yeS5jZXJ0dW0ucGwvY3NtaW1lcnNhY2EuY2VyMB8GA1UdIwQYMBaAFGb7ww++9L/gnMmr
Td5HGb3AyqZoMB0GA1UdDgQWBBQej7nlaxX39WVBUY+aBFMp+c99RzBMBgNVHSAERTBDMAkGB2eB
DAEFAQIwNgYLKoRoAYb2dwJkAgEwJzAlBggrBgEFBQcCARYZaHR0cHM6Ly93d3cuY2VydHVtLnBs
L0NQUzAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwDgYDVR0PAQH/BAQDAgTwMBwGA1Ud
EQQVMBOBEWpzY290dEBwb3N0ZW8ubmV0MA0GCSqGSIb3DQEBCwUAA4ICAQB+Oua8ErSAIhxfeM+I
KN89z4gk+OJRLVxhvJ81We2s/NH5DWwxH3kKL+C8a88xuO0LY/kLSiog7zgWl3olyNbnOM6vnfNz
YWRZqC6TZEh+b02vn6h9/UIsNbB5npZS6H5P9bwF7RQzpxhDmstXsw1knfKtqIliG5EU06D3Npuy
TkDFTsBvGaMiMOLMA9IzELyg8VDjJNbQ+PlVh+ZALKlbBhAjR869mwsqRYK1YHGArNndyUvgGF2J
2JlOhUvhfkiFS0IKCa1fYCJU+xQVKxSO4j2fob1wuLFRqP2luNh2G7LsD1mOw3qKcLSf/l8608On
JVZYtJDdSBgldpeugvC72bar0DvC0E9YFCkQLylwuuk4ISuexe+ieT0cXAbM3m7jJ2iYWXAc8WZZ
SuIUXEPKccQlu6ElHIwTQuUpIuUgKp6dkZY8EnYqdGM2Jn9DSh6kUFr4ePIxi6LZUdFfzjVS6w2i
TObtpE4FSUe000wciTADR0VvmLb8qrAp+uhOm/Oi6X0QHND7p2OpRCs+MqUdT5GT5oR58pKG+cMG
EZchJ3B45vmp2fDD7tVz/lFuZjcm9JM8a/xRkMy+luwqFb3y20bY8pAMi1Ov7Fut6LokemaL28r4
d0bPAeBfmj9i12tRygZpN5SZy/kZ+PfbbTrDBfBxWA0kMdhsvChinxZAGzCCBs4wggS2oAMCAQIC
ECVSDRtr8FpV2nzxlWEVFsgwDQYJKoZIhvcNAQELBQAwTjELMAkGA1UEBhMCUEwxITAfBgNVBAoM
GEFzc2VjbyBEYXRhIFN5c3RlbXMgUy5BLjEcMBoGA1UEAwwTQ2VydHVtIFNNSU1FIFJTQSBDQTAe
Fw0yNTA0MDUwMzQwMjZaFw0yNjA0MDUwMzQwMjVaMD4xGjAYBgNVBAMMEWpzY290dEBwb3N0ZW8u
bmV0MSAwHgYJKoZIhvcNAQkBFhFqc2NvdHRAcG9zdGVvLm5ldDCCAiIwDQYJKoZIhvcNAQEBBQAD
ggIPADCCAgoCggIBAMGCQxB2MnqxQXP08/dE2d5v78+3ucS2UiFvb9FN0b0j/BifMZvN/9bumJzp
mpVwd0d5JR9+9M/svSRf4hIBf+hLGtYJrbtte5jYEPPAlXYSoHyNybf7ko1uJ/rHldKdvga5G6fN
fThyMVb7ODDuikIDj8DFnJAi7GDuu/LD6evazvNMIwk0ii6E1qgzf61kHw3nVp3hGs3SSm4AXj+I
9ySiap7f9+h8mjqM/z2WdXfWAp07IRa5TfDhmfMjIKlIHGoO2zf9D4i7ml12ojv/yycmjRJJnFs0
Q5ic4yP5puVkC/yCjH6OMg20PaXTcPyFXhDQsmMeuAQgcD9tV8O3IzGU4Io9gujZPJxda1yZ7BpZ
H7jV9xuIKbL4WoQGZSZ0dwXvzpDW9NPVeEXH2us+Xfqc6VbEznMPPhtCqRgeqt603w87gnf7puzK
BPLEoQo9VCLRx5cJPlip05TtRP4PH6uOCwK5BYs3LFSnJkg7iJ8sTrEfbO+gEeboiO2TGplMGC/6
zEcVh4yM5mPjfVkFijCZw+AavzIOlE6NHCEqKET/D7wZzAZ//122lLaAZ3lNS1fO9FikACxEJ9Eb
KZJmzphU3TGCpmobcXiDB/esYIi65In7dKy+B0XE7zDy5KZboKYz9o/N4u6lfUJb9Gf6kEmBJDTc
yYUZZ2pJPyjwMRUvAgMBAAGjggG2MIIBsjAMBgNVHRMBAf8EAjAAMEEGA1UdHwQ6MDgwNqA0oDKG
MGh0dHA6Ly9jc21pbWVyc2FjYS5jcmwuY2VydHVtLnBsL2NzbWltZXJzYWNhLmNybDCBgwYIKwYB
BQUHAQEEdzB1MC4GCCsGAQUFBzABhiJodHRwOi8vY3NtaW1lcnNhY2Eub2NzcC1jZXJ0dW0uY29t
MEMGCCsGAQUFBzAChjdodHRwOi8vY3NtaW1lcnNhY2EucmVwb3NpdG9yeS5jZXJ0dW0ucGwvY3Nt
aW1lcnNhY2EuY2VyMB8GA1UdIwQYMBaAFGb7ww++9L/gnMmrTd5HGb3AyqZoMB0GA1UdDgQWBBQe
j7nlaxX39WVBUY+aBFMp+c99RzBMBgNVHSAERTBDMAkGB2eBDAEFAQIwNgYLKoRoAYb2dwJkAgEw
JzAlBggrBgEFBQcCARYZaHR0cHM6Ly93d3cuY2VydHVtLnBsL0NQUzAdBgNVHSUEFjAUBggrBgEF
BQcDBAYIKwYBBQUHAwIwDgYDVR0PAQH/BAQDAgTwMBwGA1UdEQQVMBOBEWpzY290dEBwb3N0ZW8u
bmV0MA0GCSqGSIb3DQEBCwUAA4ICAQB+Oua8ErSAIhxfeM+IKN89z4gk+OJRLVxhvJ81We2s/NH5
DWwxH3kKL+C8a88xuO0LY/kLSiog7zgWl3olyNbnOM6vnfNzYWRZqC6TZEh+b02vn6h9/UIsNbB5
npZS6H5P9bwF7RQzpxhDmstXsw1knfKtqIliG5EU06D3NpuyTkDFTsBvGaMiMOLMA9IzELyg8VDj
JNbQ+PlVh+ZALKlbBhAjR869mwsqRYK1YHGArNndyUvgGF2J2JlOhUvhfkiFS0IKCa1fYCJU+xQV
KxSO4j2fob1wuLFRqP2luNh2G7LsD1mOw3qKcLSf/l8608OnJVZYtJDdSBgldpeugvC72bar0DvC
0E9YFCkQLylwuuk4ISuexe+ieT0cXAbM3m7jJ2iYWXAc8WZZSuIUXEPKccQlu6ElHIwTQuUpIuUg
Kp6dkZY8EnYqdGM2Jn9DSh6kUFr4ePIxi6LZUdFfzjVS6w2iTObtpE4FSUe000wciTADR0VvmLb8
qrAp+uhOm/Oi6X0QHND7p2OpRCs+MqUdT5GT5oR58pKG+cMGEZchJ3B45vmp2fDD7tVz/lFuZjcm
9JM8a/xRkMy+luwqFb3y20bY8pAMi1Ov7Fut6LokemaL28r4d0bPAeBfmj9i12tRygZpN5SZy/kZ
+PfbbTrDBfBxWA0kMdhsvChinxZAGzGCA+IwggPeAgEBMGIwTjELMAkGA1UEBhMCUEwxITAfBgNV
BAoMGEFzc2VjbyBEYXRhIFN5c3RlbXMgUy5BLjEcMBoGA1UEAwwTQ2VydHVtIFNNSU1FIFJTQSBD
QQIQJVING2vwWlXafPGVYRUWyDANBglghkgBZQMEAgEFAKCCAVEwGAYJKoZIhvcNAQkDMQsGCSqG
SIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjUxMjEwMDQ0MTI3WjAvBgkqhkiG9w0BCQQxIgQgOfU6
Aj2WQrEYWay+/Mia3m+Ye6g85WARLkjcqannRBEwcQYJKwYBBAGCNxAEMWQwYjBOMQswCQYDVQQG
EwJQTDEhMB8GA1UECgwYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMRwwGgYDVQQDDBNDZXJ0dW0g
U01JTUUgUlNBIENBAhAlUg0ba/BaVdp88ZVhFRbIMHMGCyqGSIb3DQEJEAILMWSgYjBOMQswCQYD
VQQGEwJQTDEhMB8GA1UECgwYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMRwwGgYDVQQDDBNDZXJ0
dW0gU01JTUUgUlNBIENBAhAlUg0ba/BaVdp88ZVhFRbIMA0GCSqGSIb3DQEBAQUABIICAJPyUlHS
ILFHoOWtYWKW5T3erACzPvcV2yl4Mmj5mZHBPZxXsTUs+kx5BeCNQ5uJD2Go1sWfyTcvp10Da5WP
LN0oEu+GXZnfIW9NfpV8TK3qbCmM3tP9UvJq7U+56Kwbho+f82vY503QXMV7QymlF2TwkKd+zdQV
3OvCdiaC3YN3p6LXhWi1iv0TXN7uJnVm9cLg1VGTamxv95T4VX/egdO1AWeRM9s8kUjnytbStZgx
4mq3laIOUKINnXV+c1KFBBpScfWNId3ilESf7Dw5+z7i9sbgXeFqdz1s2ap/y7Cflb08Q6eiFCWQ
H4PtJYqALd8mevFouVhJKTWK75h5phLFEk8lydZEV7U5A7hH8+Sde6ktXZw5LLiNujp/Bpp3iYQE
hNvdz06bpOp+w1uza8XGQSTrMxTQRODm/vD6U+jnyg6WUPtFC4/t/MzvcwCsmeQteLgKfZ5A9UTp
mf8U3mexhQMzeeiGD3DTxRZQtP/yAAjGMbKtyq2voKMaVNqsNQgsr/mruJxEi2nirJZbHsQSBkdj
vfh269VCteDEXZvsgRpVxH7ECuPOwAZxSrcKofOI/v7oy05gaV10VxCptaFPvfWrJcSGJwplGfpe
YjHcuZdCKBeBJS0BEnzyxDF6HhGlQTa5ubgvVMSoCi5vJB5NUcLftl7lOtzOobyMtlyLAAAAAAAA



--=-gFu1ThpIej7h595+8IS/--


--===============3015054516388746187==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
pkg-gnome-maintainers mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-gnome-maintainers

--===============3015054516388746187==--