Repository: bower/bower (js)

Issue:
bower install ends in `unable to access 'https://github.com/jquery/jquery-dist.git/': SSL: CA certificate set, but certificate verification is disabled`
I am not able to install (anything?) with bower. I am trying to use the public GitHub and a popular library but I get error: `git ls-remote --tags --heads https://github.com/jquery/jquery-dist.git", exit code of #128 fatal: unable to access 'https://github.com/jquery/jquery-dist.git/': SSL: CA certificate set, but certificate verification is disabled`
# Details:

Additional error details:

**Output of `bower -v && npm -v && node -v`:**

```
1.7.9
3.10.3
v6.5.0
```

**Additional environment details (proxy, private registry, etc.):**
I have disabled everything I know.

**Steps to reproduce the issue:**
1.  `bower install jquery`

**Describe the results you received:**

```
bower install jquery
bower jquery#*              not-cached https://github.com/jquery/jquery-dist.git#*
bower jquery#*                 resolve https://github.com/jquery/jquery-dist.git#*
bower jquery#*                 ECMDERR Failed to execute "git ls-remote --tags --heads https://github.com/jquery/jquery-dist.git", exit code of #128 fatal: unable to access 'https://github.com/jquery/jquery-dist.git/': SSL: CA certificate set, but certificate verification is disabled
```

**Describe the results you expected:**

I expected Bower to finish the without errors.

**Additional information:**
1. I have tried this in the command without and no errors. It shows `Content-Type: application/x-git-upload-pack-advertisement`

```
GIT_CURL_VERBOSE=2 git ls-remote --heads https://github.com/jquery/jquery-dist.git
```
1. I was sneaking in the source code and the error comes from [cmd.js#L102](https://github.com/bower/bower/blob/master/lib/util/cmd.js#L102) called by [GitRemoteResolver.js#L253](https://github.com/bower/bower/blob/master/lib/core/resolvers/GitRemoteResolver.js#L253) **I wonder why the command succeeds in my terminal but fails when done by bower?**
2. If it matters here is my bower.json:

```
{
  "name": "webcomp",
  "authors": [
    "me <me@email.com>"
  ],
  "description": "",
  "main": "",
  "license": "MIT",
  "homepage": "",
  "private": true,
  "ignore": [
    "**/.*",
    "node_modules",
    "bower_components",
    "test",
    "tests"
  ]
}
```


Pull request:
Fix #2360 by reverting "set GIT_SSL_NO_VERIFY for opposite value than
Fix #2360 by reverting "set GIT_SSL_NO_VERIFY for opposite value than strictSsl"

This reverts commit f0a54d0018927f8f1cf85cb6c7e12a37cea49333 and adds some comments in the tests


Patch:
diff --git a/lib/core/resolvers/GitResolver.js b/lib/core/resolvers/GitResolver.js
index 9f4917f6..9c64e727 100644
--- a/lib/core/resolvers/GitResolver.js
+++ b/lib/core/resolvers/GitResolver.js
@@ -26,7 +26,9 @@ function GitResolver(decEndpoint, config, logger) {
     // anyway
     mkdirp.sync(config.storage.empty);
     process.env.GIT_TEMPLATE_DIR = config.storage.empty;
-    process.env.GIT_SSL_NO_VERIFY = (!config.strictSsl).toString();
+    if (!config.strictSsl) {
+        process.env.GIT_SSL_NO_VERIFY = 'true';
+    }
     process.env.GIT_TERMINAL_PROMPT = config.interactive ? '1' : '0';
 
     Resolver.call(this, decEndpoint, config, logger);


Test patch:
diff --git a/test/core/resolvers/gitResolver.js b/test/core/resolvers/gitResolver.js
index 2ec33ad8..92a4242e 100644
--- a/test/core/resolvers/gitResolver.js
+++ b/test/core/resolvers/gitResolver.js
@@ -50,16 +50,17 @@ describe('GitResolver', function () {
             expect(process.env).to.not.have.property('GIT_SSL_NO_VERIFY');
 
             resolver = new GitResolver(decEndpoint, defaultConfig(), logger);
-            expect(process.env).to.have.property('GIT_SSL_NO_VERIFY', 'false');
-            delete process.env.GIT_SSL_NO_VERIFY;
+            expect(process.env).to.not.have.property('GIT_SSL_NO_VERIFY');
 
             resolver = new GitResolver(decEndpoint, defaultConfig({strictSsl: false}), logger);
             expect(process.env).to.have.property('GIT_SSL_NO_VERIFY', 'true');
             delete process.env.GIT_SSL_NO_VERIFY;
 
+            // git only checks the existence of GIT_SSL_NO_VERIFY.
+            // git does NOT check whether is true of false.
+            // Hence not exporting GIT_SSL_NO_VERIFY is effectively equivalent to 'false'
             resolver = new GitResolver(decEndpoint, defaultConfig({strictSsl: true}), logger);
-            expect(process.env).to.have.property('GIT_SSL_NO_VERIFY', 'false');
-            delete process.env.GIT_SSL_NO_VERIFY;
+            expect(process.env).to.not.have.property('GIT_SSL_NO_VERIFY');
         });
     });