[pkg-ntp-maintainers] Bug#851096: Bug#851096: update-leap tries to fetch https:// using a module without HTTPS support

[Kurt Roeckx]

On Wed, Jan 11, 2017 at 06:23:58PM -0500, Anthony DeRobertis wrote:
> Package: ntp
> Version: 1:4.2.8p9+dfsg-2
> Severity: normal
> File: /usr/bin/update-leap
> 
> It seems update-leap is just broken, with the default options, because
> it attempts to use File::Fetch to grab an https:// URL, but File::Fetch
> doesn't support https:// URLs.
> 
> Note that newer version of File::Fetch (apparently, starting in 0.50,
> from August 2016) supports https:// but Debian doesn't have that
> version, at least in testing.

You should probably use the file from tzdata instead:
/usr/share/zoneinfo/leap-seconds.list

I also don't trust that script, looking at:
# Where to put temporary copy before it's validated
my $TMPFILE="/tmp/leap-seconds.$$.tmp";


Kurt