perl: verify_SSL=>1 by default in HTTP::Tiny

[stigtsp]

Description of changes

Perl's core HTTP::Tiny module does not verify TLS/SSL connections by default. This PR applies a proposed patch from Debian by @jmdh to fix that.

• Patch: https://salsa.debian.org/perl-team/interpreter/perl/-/commit/1490431e40e22052f75a0b3449f1f53cbd27ba92
• Discussion: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=954089

Upstream has decided against changing the default due to backwards compatibility concerns.

• verify_SSL being true by default (redux) chansen/p5-http-tiny#134
• Shouldn't verify_SSL be true by default? chansen/p5-http-tiny#68

So this is an opinionated patch which would break for users of HTTP::Tiny that rely on the insecure default.

Example:

$ perl -MIO::Socket::SSL -MHTTP::Tiny -E 'my $res = HTTP::Tiny->new->get(q(https://wrong.host.badssl.com/)); say qq($res->{status} $res->{reason})'
200 OK

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 22.11 Release Notes (or backporting 22.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

[stigtsp]

@GrahamcOfBorg build perl

[zakame]

💯

[stigtsp]

Some thoughts:

It's likely that this will break stuff, like tests that connect to TLS servers with self signed certificates. I'll keep an eye on Hydra for this when it reaches staging-next.

But, breakage from modules/tools that connect to (invalid) HTTPS resources on the internet will be harder to catch since our tests are network isolated. But breaking insecure HTTPS usage would be a good thing, imho.