From e0168180824ab04d8ee6d798efb039bf3d5555dc Mon Sep 17 00:00:00 2001
From: Jan Stodola <honza.stodola@gmail.com>
Date: Sat, 31 Oct 2020 22:16:35 +0100
Subject: [PATCH] Fix checking ssl certificate for metadata (#1745064)

If the url kickstart command is used with the --noverifyssl option, the
ssl certificate check needs to be disabled for the repository metadata.

Resolves: rhbz#1745064
---
 pyanaconda/payload/dnf/payload.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pyanaconda/payload/dnf/payload.py b/pyanaconda/payload/dnf/payload.py
index 623518c66..f146b0dce 100644
--- a/pyanaconda/payload/dnf/payload.py
+++ b/pyanaconda/payload/dnf/payload.py
@@ -1677,7 +1677,8 @@ class DNFPayload(Payload):
         #   - the path to a cert file
         #   - True, to use the system's certificates
         #   - False, to not verify
-        ssl_verify = data.ssl_configuration.ca_cert_path or conf.payload.verify_ssl
+        ssl_verify = (data.ssl_configuration.ca_cert_path
+                      or (conf.payload.verify_ssl and data.ssl_verification_enabled))
         ssl_client_cert = data.ssl_configuration.client_cert_path or None
         ssl_client_key = data.ssl_configuration.client_key_path or None
         ssl_cert = (ssl_client_cert, ssl_client_key) if ssl_client_cert else None
-- 
2.23.0