Subject: bug#27778: closed (Re: bug#27778: Changing package source URLs from git:// to https://)

From: [email-masked] (GNU bug Tracking System)
Date: Sun, 27 Aug 2017 22:38:02 +0000

Your bug report

#27778: Changing package source URLs from git:// to https://

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
27778: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=27778
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#27778: Changing package source URLs from git:// to https://
From: Leo Famulari <[email-masked]>
To: Mark H Weaver <[email-masked]>
Cc: [email-masked]
Date: Sun, 27 Aug 2017 18:36:46 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

On Tue, Jul 25, 2017 at 02:00:52PM -0400, Leo Famulari wrote:
> On Tue, Jul 25, 2017 at 03:12:50AM -0400, Mark H Weaver wrote:
> > Leo Famulari <[email-masked]> writes:
> > 
> > > On Thu, Jul 20, 2017 at 06:06:31PM -0400, Leo Famulari wrote:
> > >> Let's change these packages to use HTTPS or HTTP!
> > >
> > > Well, I don't know any benefit to using HTTP over GIT, so I'm not going
> > > to change the packages whose sources are not available over HTTPS.
> > 
> > One benefit is that HTTP is more readily accessible via proxy servers,
> > which is useful for people behind restrictive firewalls, or those who
> > wish to use Tor.
> 
> Okay, that's indeed a plus for HTTP. I'll review the leftover packages
> and see if we can fetch the source over HTTP.

I didn't find any package sources using GIT that could use HTTP
but not HTTPS. I pushed my changes related to this bug report as
5f13bf0972310dfd5e2f26a4adc8b5aab4be7407.

Subject: Changing package source URLs from git:// to https://
From: Leo Famulari <[email-masked]>
To: [email-masked]
Date: Thu, 20 Jul 2017 18:06:31 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

There are several packages that fetch their sources over the Git
protocol. That is, 'git://'.

This protocol is unauthenticated, which is not great, although not 100%
terrible since we know the hash of what we are trying to fetch. Also, it
uses port 9418 which is blocked more often than 443 or 80.

Let's change these packages to use HTTPS or HTTP!

~/guix/gnu/packages% grep -rI 'git://'
pumpio.scm:                    (url "git://pumpa.branchable.com/")
fltk.scm:                    (url "git://git.tuxfamily.org/gitroot/non/fltk.git")
microcom.scm:                    (url "git://git.pengutronix.de/git/tools/microcom.git")
rdesktop.scm:                    (url "git://github.com/FreeRDP/FreeRDP.git")
gnunet.scm:                      (url "git://git.sv.gnu.org/guix/gnunet.git")
suckless.scm:               (url "git://git.2f30.org/human.git")
admin.scm:                      (url "git://github.com/TrilbyWhite/interrobang")
embedded.scm:                      (url "git://git.zapb.de/libjaylink.git")
embedded.scm:                      (url "git://git.code.sf.net/p/openocd/code.git")
version-control.scm:             (url "git://myrepos.branchable.com/myrepos")
audio.scm:                    (url "git://git.ardour.org/ardour/ardour.git")
emacs.scm:                    (url "git://git.hcoop.net/git/bpt/emacs.git")
messaging.scm:                    (url "git://git.psyced.org/git/psyclpc")
music.scm:                      (url "git://git.tuxfamily.org/gitroot/non/non.git")
python.scm:             (url "git://github.com/tgalal/python-axolotl-curve25519")
web.scm:                    (url "git://git.libwebsockets.org/libwebsockets")
gnome.scm:                      (url "git://git.gnome.org/byzanz")
guile.scm:                    (url "git://git.hcoop.net/git/bpt/guile.git")
guile.scm:                      (url "git://dthompson.us/guile-syntax-highlight.git")
java.scm:                      (url "git://git.savannah.gnu.org/classpath.git")
shells.scm:                    (url "git://github.com/rakitzis/rc.git")