sysutils/nextcloud-backup: add option to disable SSL verification

[enoch85]

Adds an optional "Verify SSL certificate" checkbox to the Nextcloud backup settings.

• Defaults to enabled; existing behavior is unchanged on upgrade.
• When unchecked, CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are disabled in
  curl_request_nothrow(), so backups work against Nextcloud instances behind self-signed
  or otherwise untrusted certificates.
• Without this, users have to hand-edit Nextcloud.php after every plugin update.

Relates to #3405 (accept self-signed certificates) and #4422 (custom CA roots).

Changes:

• NextcloudSettings.xml: new verify_ssl BooleanField, default 1; model version 1.0.2 -> 1.0.3
• Nextcloud.php: UI field in getConfigurationFields(), curl options in curl_request_nothrow()
• Makefile: plugin version 1.2 -> 1.3
• pkg-descr: changelog entry

[fichtner]

We tend to reject these because they degrade security for no reason. It’s easy enough to add the CA or self-signed cert to system: trust: authorities.

[enoch85]

We tend to reject these because they degrade security for no reason. It’s easy enough to add the CA or self-signed cert to system: trust: authorities.

Yeah I get that. It's really just for convenience, and IMHO it's a simple checkbox with a QoL improvement for your users (including me).

The default is on, so no real security implications if you don't intentionally tick it.

In my case I run let's encrypt and wouldn't that mean adding to authorities every three months?

[fichtner]

Let’s encrypt roots should be stable for years. A bit strange they are not in the default store, but they should be readily available for download on their end.

[enoch85]

Let’s encrypt roots should be stable for years. A bit strange they are not in the default store, but they should be readily available for download on their end.

Ok, thanks!

Anyway, please consider it. 🙏🏼

[Monviech]

Please consider using plaintext if you don't want proper trust xD

[enoch85]

Please consider using plaintext if you don't want proper trust xD

Well, I could do it over http since it's on localhost anyway, but...