From e2040585783c4b8e237068d43e8717afe41fa43f Mon Sep 17 00:00:00 2001
From: Claudius Kienle <claudius.kienle@tu-darmstadt.de>
Date: Tue, 14 Apr 2026 14:49:38 +0200
Subject: [PATCH 1/2] quickget: add --insecure flag to skip SSL certificate
 verification

Some download hosts (e.g. spice-space.org) occasionally serve content
with expired SSL certificates. Add a --insecure flag and a
QUICKGET_INSECURE=1 env var so users can opt in to bypassing curl's
certificate verification without having to patch the script manually.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 quickget | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/quickget b/quickget
index 5044af7..5751a34 100755
--- a/quickget
+++ b/quickget
@@ -1413,6 +1413,8 @@ function web_pipe_json() {
 function web_get() {
     local CHECK=""
     local HEADERS=()
+    local INSECURE=()
+    [ "${CURL_INSECURE}" == "true" ] && INSECURE=("--insecure")
     local URL="${1}"
     local DIR="${2}"
     local FILE=""
@@ -1464,7 +1466,7 @@ function web_get() {
         echo "- URL: ${URL}"
     fi
 
-    if ! curl --disable --progress-bar --location --output "${DIR}/${FILE}" --continue-at - --user-agent "${USER_AGENT}" "${HEADERS[@]}" -- "${URL}"; then
+    if ! curl --disable --progress-bar --location --output "${DIR}/${FILE}" --continue-at - --user-agent "${USER_AGENT}" "${HEADERS[@]}" "${INSECURE[@]}" -- "${URL}"; then
         echo "ERROR! Failed to download ${URL} with curl."
         rm -f "${DIR}/${FILE}"
         exit 1
@@ -3766,6 +3768,7 @@ Arguments:
    --arch           <arch>                    : Set architecture (arm64, aarch64, amd64, x86_64)
    --download       <os> <release> [edition]  : Download image; no VM configuration
    --create-config  <os> [path/url] [flags]   : Create VM config for an OS image
+   --insecure                                 : Skip SSL certificate verification (or set QUICKGET_INSECURE=1)
    --open-homepage  <os>                      : Open homepage for the OS
    --show           [os]                      : Show OS information
    --version                                  : Show version
@@ -3797,6 +3800,7 @@ QUICKEMU=$(resolve_quickemu)
 I18NS=()
 OPERATION=""
 CHECK_ALL_ARCH="false"
+CURL_INSECURE="${QUICKGET_INSECURE:-false}"
 # Normalised host architecture for foreign arch detection
 NORMALISED_HOST_ARCH="${ARCH}"
 CURL=$(command -v curl)
@@ -3915,6 +3919,10 @@ case "${1}" in
     --list-csv|-list-csv|list|list_csv) list_csv;;
     --list-json|-list-json|list_json) list_json;;
     --list|-list) list_supported;;
+    --insecure|-insecure)
+        CURL_INSECURE="true"
+        shift
+        ;;
     -*) error_not_supported_argument;;
 esac
 

From a8970b39cb2900d5ed870d36939165de3d1e3942 Mon Sep 17 00:00:00 2001
From: Claudius Kienle <claudius.kienle@tu-darmstadt.de>
Date: Tue, 14 Apr 2026 14:59:47 +0200
Subject: [PATCH 2/2] quickget: normalize QUICKGET_INSECURE env var to accept
 both 1 and true

The previous assignment CURL_INSECURE="${QUICKGET_INSECURE:-false}" meant
QUICKGET_INSECURE=1 set CURL_INSECURE to "1", but the downstream check
only matched "true", so the env var had no effect. Accept both "1" and
"true" by normalizing to "true"/"false" at assignment time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 quickget | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/quickget b/quickget
index 5751a34..2d7019f 100755
--- a/quickget
+++ b/quickget
@@ -3800,7 +3800,8 @@ QUICKEMU=$(resolve_quickemu)
 I18NS=()
 OPERATION=""
 CHECK_ALL_ARCH="false"
-CURL_INSECURE="${QUICKGET_INSECURE:-false}"
+CURL_INSECURE="false"
+[[ "${QUICKGET_INSECURE:-}" == "1" || "${QUICKGET_INSECURE:-}" == "true" ]] && CURL_INSECURE="true"
 # Normalised host architecture for foreign arch detection
 NORMALISED_HOST_ARCH="${ARCH}"
 CURL=$(command -v curl)