SVN Operations Disable TLS Certificate Verification, Creating Critical Supply Chain Risk

A critical security vulnerability has been identified in SVN export and import operations, where TLS certificate verification is explicitly disabled. The code uses the `--trust-server-cert-failures` flag to accept any certificate, including those from unknown certificate authorities or with mismatched names. This action completely neutralizes the security benefits of HTTPS encryption, opening a direct path for man-in-the-middle attacks. An attacker with the right network position could intercept and inject malicious code into release artifacts during transit, with no detection at the transport layer.

The vulnerability is located in specific files within the codebase. In `atr/tasks/svn.py`, lines 73-84 handle SVN export with disabled certificate verification, and lines 93-103 handle SVN import with the same insecure configuration. This explicit bypass of standard validation protocols means the integrity of downloaded artifacts cannot be trusted during the transfer process. The security of the entire supply chain now depends solely on post-download verification checks, which may not be present or sufficient.

This flaw represents a severe supply chain security risk, particularly for organizations relying on these operations for software releases. It undermines a fundamental security control and exposes downstream systems and users to potential compromise. The recommended remediation is to remove the `--trust-server-cert-failures` flag and enforce proper TLS certificate validation to restore the integrity of the artifact import and export process.