Minor fixes after PR review

Author: orthoxerox

README.md

@@ -581,10 +581,11 @@ Command | Description
   Sets the root URL for downloading self-updates.
 
 - `RUSTUP_USE_UNSAFE_SSL` (default: none)
-  If set, rustup will not validate the SSL certificate when downloading
-  files. This parameter should be used only in exceptional circumstances
-  when youre computer is behind a corporate proxy that injects its own
-  certificates into HTTPS connections.
+  If set to "ACCEPT_RISKS", rustup will not validate the SSL certificate 
+  when downloading files. This parameter should be used only in exceptional
+  circumstances when your computer is behind a corporate proxy that injects
+  its own certificates into HTTPS connections and you're unable to add these 
+  certificates to your root set.
 
 ## Other installation methods
 

rustup-init.sh

@@ -386,7 +386,7 @@ downloader() {
         _dld='curl or wget' # to be used in error message of need_cmd
     fi
 
-	if [ -n "$RUSTUP_USE_UNSAFE_SSL" ]; then
+	if [ "$RUSTUP_USE_UNSAFE_SSL" = "ACCEPT_RISKS" ]; then
 		_curl_unsafe = "--insecure"
 		_wget_unsafe = "--no-check-certificate"
 	else

src/download/Cargo.toml

@@ -28,4 +28,4 @@ hyper = "0.12"
 tempdir = "0.3.4"
 tokio = "0.1.11"
 tokio-tls = "0.2.1"
-native-tls = "0.2.1"
+native-tls = "0.2.1"

src/download/src/lib.rs

@@ -130,7 +130,7 @@ pub fn download_to_path_with_backend(
 }
 
 fn use_unsafe_ssl() -> bool {
-    env::var_os("RUSTUP_USE_UNSAFE_SSL").is_some()
+    env::var_os("RUSTUP_USE_UNSAFE_SSL").unwrap_or("NO".into()) == "ACCEPT_RISKS"
 }
 
 /// Download via libcurl; encrypt with the native (or OpenSSl) TLS
@@ -181,9 +181,11 @@ pub mod curl {
                 .connect_timeout(Duration::new(30, 0))
                 .chain_err(|| "failed to set connect timeout")?;
 
-            handle
-                .ssl_verify_peer(!use_unsafe_ssl())
-                .chain_err(|| "failed to configure unsafe SSL mode")?;
+            if use_unsafe_ssl() {
+                handle
+                    .ssl_verify_peer(false)
+                    .chain_err(|| "failed to configure unsafe SSL mode")?;
+            }
 
             {
                 let cberr = RefCell::new(None);

src/download/tests/download-curl-safe.rs

@@ -5,8 +5,9 @@ use download::*;
 mod support;
 use crate::support::{file_contents, serve_file, tmp_dir};
 
-/// There are two separate files because this crate caches curl handles
-/// and all tests in one file use either the safe or the unsafe handle
+// There are two separate files because this crate caches curl handles
+// and all tests in one file use either the safe or the unsafe handle.
+// See download-curl-unsafe.rs for the complementary test case.
 
 #[test]
 fn downloading_with_no_certificate() {
@@ -40,3 +41,22 @@ fn downloading_with_bad_certificate() {
 
     assert_eq!(file_contents(&target_path), "12345");
 }
+
+#[test]
+#[should_panic]
+fn downloading_with_bad_certificate_using_wrong_env_value() {
+    let tmpdir = tmp_dir();
+    let target_path = tmpdir.path().join("downloaded");
+
+    let addr = serve_file(b"12345".to_vec(), true);
+    let from_url = format!("https://{}", addr).parse().unwrap();
+
+    std::env::set_var("RUSTUP_USE_UNSAFE_SSL", "FOOBAR");
+
+    assert_eq!(std::env::var_os("RUSTUP_USE_UNSAFE_SSL").is_some(), true);
+
+    download_to_path_with_backend(Backend::Curl, &from_url, &target_path, false, None)
+        .expect("Test download failed");
+
+    assert_eq!(file_contents(&target_path), "12345");
+}

src/download/tests/download-curl-unsafe.rs

@@ -5,8 +5,9 @@ use download::*;
 mod support;
 use crate::support::{file_contents, serve_file, tmp_dir};
 
-/// There are two separate files because this crate caches reqwest handles
-/// and all tests in one file use either the safe or the unsafe handle
+// There are two separate files because this crate caches curl handles
+// and all tests in one file use either the safe or the unsafe handle.
+// See download-curl-safe.rs for the complementary test case.
 
 #[test]
 fn downloading_with_bad_certificate_unsafely() {
@@ -16,7 +17,7 @@ fn downloading_with_bad_certificate_unsafely() {
     let addr = serve_file(b"12345".to_vec(), true);
     let from_url = format!("https://{}", addr).parse().unwrap();
 
-    std::env::set_var("RUSTUP_USE_UNSAFE_SSL", "1");
+    std::env::set_var("RUSTUP_USE_UNSAFE_SSL", "ACCEPT_RISKS");
 
     assert_eq!(std::env::var_os("RUSTUP_USE_UNSAFE_SSL").is_some(), true);
 

src/download/tests/download-reqwest-safe.rs

@@ -5,8 +5,9 @@ use download::*;
 mod support;
 use crate::support::{file_contents, serve_file, tmp_dir};
 
-/// There are two separate files because this crate caches reqwest handles
-/// and all tests in one file use either the safe or the unsafe handle
+// There are two separate files because this crate caches reqwest clients
+// and all tests in one file use either the safe or the unsafe client.
+// See download-reqwest-unsafe.rs for the complementary test case.
 
 #[test]
 fn downloading_with_no_certificate() {
@@ -40,3 +41,23 @@ fn downloading_with_bad_certificate() {
 
     assert_eq!(file_contents(&target_path), "12345");
 }
+
+
+#[test]
+#[should_panic]
+fn downloading_with_bad_certificate_using_wrong_env_value() {
+    let tmpdir = tmp_dir();
+    let target_path = tmpdir.path().join("downloaded");
+
+    let addr = serve_file(b"12345".to_vec(), true);
+    let from_url = format!("https://{}", addr).parse().unwrap();
+
+    std::env::set_var("RUSTUP_USE_UNSAFE_SSL", "FOOBAR");
+
+    assert_eq!(std::env::var_os("RUSTUP_USE_UNSAFE_SSL").is_some(), true);
+
+    download_to_path_with_backend(Backend::Reqwest, &from_url, &target_path, false, None)
+        .expect("Test download failed");
+
+    assert_eq!(file_contents(&target_path), "12345");
+}

src/download/tests/download-reqwest-unsafe.rs

@@ -5,8 +5,9 @@ use download::*;
 mod support;
 use crate::support::{file_contents, serve_file, tmp_dir};
 
-/// There are two separate files because this crate caches reqwest handles
-/// and all tests in one file use either the safe or the unsafe handle
+// There are two separate files because this crate caches reqwest clients
+// and all tests in one file use either the safe or the unsafe client.
+// See download-reqwest-safe.rs for the complementary test case.
 
 #[test]
 fn downloading_with_bad_certificate_unsafely() {
@@ -16,7 +17,7 @@ fn downloading_with_bad_certificate_unsafely() {
     let addr = serve_file(b"12345".to_vec(), true);
     let from_url = format!("https://{}", addr).parse().unwrap();
 
-    std::env::set_var("RUSTUP_USE_UNSAFE_SSL", "1");
+    std::env::set_var("RUSTUP_USE_UNSAFE_SSL", "ACCEPT_RISKS");
 
     assert_eq!(std::env::var_os("RUSTUP_USE_UNSAFE_SSL").is_some(), true);