GNU bug report logs - #27778
Changing package source URLs from git:// to https://

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Leo Famulari <leo <at> famulari.name>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#27778: closed (Changing package source URLs from git:// to
 https://)
Date: Sun, 27 Aug 2017 22:38:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Sun, 27 Aug 2017 18:36:46 -0400
with message-id <20170827223646.GA7477 <at> jasmine.lan>
and subject line Re: bug#27778: Changing package source URLs from git:// to https://
has caused the debbugs.gnu.org bug report #27778,
regarding Changing package source URLs from git:// to https://
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
27778: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=27778
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Leo Famulari <leo <at> famulari.name>
To: bug-guix <at> gnu.org
Subject: Changing package source URLs from git:// to https://
Date: Thu, 20 Jul 2017 18:06:31 -0400

[Message part 3 (text/plain, inline)]

There are several packages that fetch their sources over the Git
protocol. That is, 'git://'.

This protocol is unauthenticated, which is not great, although not 100%
terrible since we know the hash of what we are trying to fetch. Also, it
uses port 9418 which is blocked more often than 443 or 80.

Let's change these packages to use HTTPS or HTTP!

~/guix/gnu/packages% grep -rI 'git://'
pumpio.scm:                    (url "git://pumpa.branchable.com/")
fltk.scm:                    (url "git://git.tuxfamily.org/gitroot/non/fltk.git")
microcom.scm:                    (url "git://git.pengutronix.de/git/tools/microcom.git")
rdesktop.scm:                    (url "git://github.com/FreeRDP/FreeRDP.git")
gnunet.scm:                      (url "git://git.sv.gnu.org/guix/gnunet.git")
suckless.scm:               (url "git://git.2f30.org/human.git")
admin.scm:                      (url "git://github.com/TrilbyWhite/interrobang")
embedded.scm:                      (url "git://git.zapb.de/libjaylink.git")
embedded.scm:                      (url "git://git.code.sf.net/p/openocd/code.git")
version-control.scm:             (url "git://myrepos.branchable.com/myrepos")
audio.scm:                    (url "git://git.ardour.org/ardour/ardour.git")
emacs.scm:                    (url "git://git.hcoop.net/git/bpt/emacs.git")
messaging.scm:                    (url "git://git.psyced.org/git/psyclpc")
music.scm:                      (url "git://git.tuxfamily.org/gitroot/non/non.git")
python.scm:             (url "git://github.com/tgalal/python-axolotl-curve25519")
web.scm:                    (url "git://git.libwebsockets.org/libwebsockets")
gnome.scm:                      (url "git://git.gnome.org/byzanz")
guile.scm:                    (url "git://git.hcoop.net/git/bpt/guile.git")
guile.scm:                      (url "git://dthompson.us/guile-syntax-highlight.git")
java.scm:                      (url "git://git.savannah.gnu.org/classpath.git")
shells.scm:                    (url "git://github.com/rakitzis/rc.git")

[signature.asc (application/pgp-signature, inline)]

[Message part 5 (message/rfc822, inline)]

From: Leo Famulari <leo <at> famulari.name>
To: Mark H Weaver <mhw <at> netris.org>
Cc: 27778-done <at> debbugs.gnu.org
Subject: Re: bug#27778: Changing package source URLs from git:// to https://
Date: Sun, 27 Aug 2017 18:36:46 -0400

[Message part 6 (text/plain, inline)]

On Tue, Jul 25, 2017 at 02:00:52PM -0400, Leo Famulari wrote:
> On Tue, Jul 25, 2017 at 03:12:50AM -0400, Mark H Weaver wrote:
> > Leo Famulari <leo <at> famulari.name> writes:
> > 
> > > On Thu, Jul 20, 2017 at 06:06:31PM -0400, Leo Famulari wrote:
> > >> Let's change these packages to use HTTPS or HTTP!
> > >
> > > Well, I don't know any benefit to using HTTP over GIT, so I'm not going
> > > to change the packages whose sources are not available over HTTPS.
> > 
> > One benefit is that HTTP is more readily accessible via proxy servers,
> > which is useful for people behind restrictive firewalls, or those who
> > wish to use Tor.
> 
> Okay, that's indeed a plus for HTTP. I'll review the leftover packages
> and see if we can fetch the source over HTTP.

I didn't find any package sources using GIT that could use HTTP
but not HTTPS. I pushed my changes related to this bug report as
5f13bf0972310dfd5e2f26a4adc8b5aab4be7407.

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.