Allow disabling Authorization for bundle downloads

[fardke]

Hello,

To be able to download bundle from some external storage (like aws S3 or azure blob storage) it can be useful to not send Authorization header.

In order to test this modification correctly I add a sniffer (using scapy module). It's allow us to check requests send by rauc-hawkbit-updater to hawkbit container and validate headers. To make it works we must add specific capabilities. It's annoying, but I don't find any alternatives.

[Bastian-Krause]

Sorry for the long waiting time.

The feature itself looks good. Please see my comments below.

I don't really like the scapy testing approach. We could add an nginx include instead that makes nginx respond with an error if auth headers are detected, mimicking what the problematic storage providers do. If you'd like to add that, please base your work on #188.

[fardke]

Sorry for the long waiting time.

The feature itself looks good. Please see my comments below.

I don't really like the scapy testing approach. We could add an nginx include instead that makes nginx respond with an error if auth headers are detected, mimicking what the problematic storage providers do. If you'd like to add that, please base your work on #188.

Ok I think it's done. Tell me if it's ok for you.

Thank you.

[Bastian-Krause]

Thanks for your work!

I've..

• rebased this on latest master (preventing CI failures due to test: conftest: drop anonymous download hawkBit option #190)
• reworded the documentation and commit messages
• made nginx return 401 (I think that's more decriptive than 500)
• reworked the test to serve the bundle externally (this should be more stable as stumbling over wrong checksum as we did before)
• added a test that makes rauc-hawkbit-updater fail with the 401 error case.

I think this can be merged once #188 is merged (I've marked this as draft to prevent premature merging) if @ejoerns has no objections.

[fardke]

Thank you for adjustments.

[Bastian-Krause]

Now that #169 is merged, setting the new send_download_auth_header=true also prevents sending SSL client certificate authentication for bundle downloads. Since there are no headers involved, I've renamed the option from send_download_auth_header to (the more generic variant) send_download_authentication.

[Bastian-Krause]

Since I've modified the PR quite heavily myself, I'd like a review from @ejoerns before merging.