default to https mirror for Debian when no gpg verification is available

When deboostrapping Debian, and the debian-archive-keyring is not
available, switch the default mirror to a https url. This way at least the
CA level of security is available even for users who have no way to check
gpg keys in the WoT. The https mirror is currently
https://mirrors.kernel.org/debian.

When the keyring is available, the default mirror remains non-https,
for several reasons:

a) to avoid overloading mirrors.kernel.org
b) because http.us.debian.org lacks https support
c) because mirrors.kernel.org is not currently in the
   http.us.debian.org rotation
d) because mirrors.kernel.org lacks IPv6 support

1 files changed, 4 insertions, 2 deletions

diff --git a/debootstrap b/debootstrap
index dfa0abc..f7ee5d1 100755
--- a/debootstrap
+++ b/debootstrap
@@ -47,6 +47,7 @@ CHECKCERTIF=""
 PRIVATEKEY=""
 
 DEF_MIRROR="http://ftp.us.debian.org/debian"
+DEF_HTTPS_MIRROR="https://mirrors.kernel.org/debian"
 
 export LANG USE_COMPONENTS
 umask 022
@@ -374,6 +375,7 @@ else
 	fi
 	SUITE="$1"
 	TARGET="$2"
+	USER_MIRROR="$3"
 	TARGET="${TARGET%/}"
 	if [ "${TARGET#/}" = "${TARGET}" ]; then
 		if [ "${TARGET%/*}" = "$TARGET" ] ; then
@@ -533,8 +535,8 @@ if [ "$SECOND_STAGE_ONLY" = "true" ]; then
 	MIRRORS=null:
 else
 	MIRRORS="$DEF_MIRROR"
-	if [ "$3" != "" ]; then
-		MIRRORS="$3"
+	if [ "$USER_MIRROR" != "" ]; then
+		MIRRORS="$USER_MIRROR"
 		MIRRORS="${MIRRORS%/}"
 	fi
 fi