* bug#27778: Changing package source URLs from git:// to https://
@ 2017-07-20 22:06 Leo Famulari
2017-07-22 23:33 ` Leo Famulari
0 siblings, 1 reply; 6+ messages in thread
From: Leo Famulari @ 2017-07-20 22:06 UTC (permalink / raw)
To: 27778
[-- Attachment #1: Type: text/plain, Size: 2021 bytes --]
There are several packages that fetch their sources over the Git
protocol. That is, 'git://'.
This protocol is unauthenticated, which is not great, although not 100%
terrible since we know the hash of what we are trying to fetch. Also, it
uses port 9418 which is blocked more often than 443 or 80.
Let's change these packages to use HTTPS or HTTP!
~/guix/gnu/packages% grep -rI 'git://'
pumpio.scm: (url "git://pumpa.branchable.com/")
fltk.scm: (url "git://git.tuxfamily.org/gitroot/non/fltk.git")
microcom.scm: (url "git://git.pengutronix.de/git/tools/microcom.git")
rdesktop.scm: (url "git://github.com/FreeRDP/FreeRDP.git")
gnunet.scm: (url "git://git.sv.gnu.org/guix/gnunet.git")
suckless.scm: (url "git://git.2f30.org/human.git")
admin.scm: (url "git://github.com/TrilbyWhite/interrobang")
embedded.scm: (url "git://git.zapb.de/libjaylink.git")
embedded.scm: (url "git://git.code.sf.net/p/openocd/code.git")
version-control.scm: (url "git://myrepos.branchable.com/myrepos")
audio.scm: (url "git://git.ardour.org/ardour/ardour.git")
emacs.scm: (url "git://git.hcoop.net/git/bpt/emacs.git")
messaging.scm: (url "git://git.psyced.org/git/psyclpc")
music.scm: (url "git://git.tuxfamily.org/gitroot/non/non.git")
python.scm: (url "git://github.com/tgalal/python-axolotl-curve25519")
web.scm: (url "git://git.libwebsockets.org/libwebsockets")
gnome.scm: (url "git://git.gnome.org/byzanz")
guile.scm: (url "git://git.hcoop.net/git/bpt/guile.git")
guile.scm: (url "git://dthompson.us/guile-syntax-highlight.git")
java.scm: (url "git://git.savannah.gnu.org/classpath.git")
shells.scm: (url "git://github.com/rakitzis/rc.git")
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#27778: Changing package source URLs from git:// to https://
2017-07-20 22:06 bug#27778: Changing package source URLs from git:// to https:// Leo Famulari
@ 2017-07-22 23:33 ` Leo Famulari
2017-07-25 7:12 ` Mark H Weaver
2017-08-27 23:41 ` ng0
0 siblings, 2 replies; 6+ messages in thread
From: Leo Famulari @ 2017-07-22 23:33 UTC (permalink / raw)
To: 27778
[-- Attachment #1: Type: text/plain, Size: 2244 bytes --]
On Thu, Jul 20, 2017 at 06:06:31PM -0400, Leo Famulari wrote:
> Let's change these packages to use HTTPS or HTTP!
Well, I don't know any benefit to using HTTP over GIT, so I'm not going
to change the packages whose sources are not available over HTTPS.
Not available over HTTPS, as far as I can tell:
> pumpio.scm: (url "git://pumpa.branchable.com/")
> fltk.scm: (url "git://git.tuxfamily.org/gitroot/non/fltk.git")
> suckless.scm: (url "git://git.2f30.org/human.git")
> version-control.scm: (url "git://myrepos.branchable.com/myrepos")
> messaging.scm: (url "git://git.psyced.org/git/psyclpc")
> music.scm: (url "git://git.tuxfamily.org/gitroot/non/non.git")
> guile.scm: (url "git://dthompson.us/guile-syntax-highlight.git")
> guile.scm: (url "git://git.hcoop.net/git/bpt/guile.git")
Different data is served over HTTPS versus GIT, so not changed yet
(reported in <https://bugs.gnu.org/27795>):
> emacs.scm: (url "git://git.hcoop.net/git/bpt/emacs.git")
Ready to use HTTPS:
> microcom.scm: (url "git://git.pengutronix.de/git/tools/microcom.git")
> rdesktop.scm: (url "git://github.com/FreeRDP/FreeRDP.git")
> admin.scm: (url "git://github.com/TrilbyWhite/interrobang")
> embedded.scm: (url "git://git.zapb.de/libjaylink.git")
> embedded.scm: (url "git://git.code.sf.net/p/openocd/code.git")
> audio.scm: (url "git://git.ardour.org/ardour/ardour.git")
> python.scm: (url "git://github.com/tgalal/python-axolotl-curve25519")
> web.scm: (url "git://git.libwebsockets.org/libwebsockets")
> gnome.scm: (url "git://git.gnome.org/byzanz")
> java.scm: (url "git://git.savannah.gnu.org/classpath.git")
> shells.scm: (url "git://github.com/rakitzis/rc.git")
> gnunet.scm: (url "git://git.sv.gnu.org/guix/gnunet.git")
To reduce the number of annoying merge conflicts, I'm not going to push
the change until after core-updates is merged into master.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#27778: Changing package source URLs from git:// to https://
2017-07-22 23:33 ` Leo Famulari
@ 2017-07-25 7:12 ` Mark H Weaver
2017-07-25 18:00 ` Leo Famulari
2017-08-27 23:41 ` ng0
1 sibling, 1 reply; 6+ messages in thread
From: Mark H Weaver @ 2017-07-25 7:12 UTC (permalink / raw)
To: Leo Famulari; +Cc: 27778
Leo Famulari <leo@famulari.name> writes:
> On Thu, Jul 20, 2017 at 06:06:31PM -0400, Leo Famulari wrote:
>> Let's change these packages to use HTTPS or HTTP!
>
> Well, I don't know any benefit to using HTTP over GIT, so I'm not going
> to change the packages whose sources are not available over HTTPS.
One benefit is that HTTP is more readily accessible via proxy servers,
which is useful for people behind restrictive firewalls, or those who
wish to use Tor.
Mark
^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#27778: Changing package source URLs from git:// to https://
2017-07-25 7:12 ` Mark H Weaver
@ 2017-07-25 18:00 ` Leo Famulari
2017-08-27 22:36 ` Leo Famulari
0 siblings, 1 reply; 6+ messages in thread
From: Leo Famulari @ 2017-07-25 18:00 UTC (permalink / raw)
To: Mark H Weaver; +Cc: 27778
[-- Attachment #1: Type: text/plain, Size: 681 bytes --]
On Tue, Jul 25, 2017 at 03:12:50AM -0400, Mark H Weaver wrote:
> Leo Famulari <leo@famulari.name> writes:
>
> > On Thu, Jul 20, 2017 at 06:06:31PM -0400, Leo Famulari wrote:
> >> Let's change these packages to use HTTPS or HTTP!
> >
> > Well, I don't know any benefit to using HTTP over GIT, so I'm not going
> > to change the packages whose sources are not available over HTTPS.
>
> One benefit is that HTTP is more readily accessible via proxy servers,
> which is useful for people behind restrictive firewalls, or those who
> wish to use Tor.
Okay, that's indeed a plus for HTTP. I'll review the leftover packages
and see if we can fetch the source over HTTP.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#27778: Changing package source URLs from git:// to https://
2017-07-25 18:00 ` Leo Famulari
@ 2017-08-27 22:36 ` Leo Famulari
0 siblings, 0 replies; 6+ messages in thread
From: Leo Famulari @ 2017-08-27 22:36 UTC (permalink / raw)
To: Mark H Weaver; +Cc: 27778-done
[-- Attachment #1: Type: text/plain, Size: 950 bytes --]
On Tue, Jul 25, 2017 at 02:00:52PM -0400, Leo Famulari wrote:
> On Tue, Jul 25, 2017 at 03:12:50AM -0400, Mark H Weaver wrote:
> > Leo Famulari <leo@famulari.name> writes:
> >
> > > On Thu, Jul 20, 2017 at 06:06:31PM -0400, Leo Famulari wrote:
> > >> Let's change these packages to use HTTPS or HTTP!
> > >
> > > Well, I don't know any benefit to using HTTP over GIT, so I'm not going
> > > to change the packages whose sources are not available over HTTPS.
> >
> > One benefit is that HTTP is more readily accessible via proxy servers,
> > which is useful for people behind restrictive firewalls, or those who
> > wish to use Tor.
>
> Okay, that's indeed a plus for HTTP. I'll review the leftover packages
> and see if we can fetch the source over HTTP.
I didn't find any package sources using GIT that could use HTTP
but not HTTPS. I pushed my changes related to this bug report as
5f13bf0972310dfd5e2f26a4adc8b5aab4be7407.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#27778: Changing package source URLs from git:// to https://
2017-07-22 23:33 ` Leo Famulari
2017-07-25 7:12 ` Mark H Weaver
@ 2017-08-27 23:41 ` ng0
1 sibling, 0 replies; 6+ messages in thread
From: ng0 @ 2017-08-27 23:41 UTC (permalink / raw)
To: Leo Famulari; +Cc: 27778
[-- Attachment #1: Type: text/plain, Size: 911 bytes --]
Leo Famulari transcribed 3.2K bytes:
> On Thu, Jul 20, 2017 at 06:06:31PM -0400, Leo Famulari wrote:
> > Let's change these packages to use HTTPS or HTTP!
>
> Well, I don't know any benefit to using HTTP over GIT, so I'm not going
> to change the packages whose sources are not available over HTTPS.
>
> Not available over HTTPS, as far as I can tell:
Yep, 2f30.org and psyced.org have no http/https access for the git.
psyced.org has an .onion which is advised to be used, but we can't
take on the position that it is generally safe to use tor without
risks for everyone.
…
> > suckless.scm: (url "git://git.2f30.org/human.git")
…
> > messaging.scm: (url "git://git.psyced.org/git/psyclpc")
…
--
ng0
GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
GnuPG: https://n0is.noblogs.org/my-keys
https://www.infotropique.org https://krosos.org
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-08-27 23:42 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-07-20 22:06 bug#27778: Changing package source URLs from git:// to https:// Leo Famulari
2017-07-22 23:33 ` Leo Famulari
2017-07-25 7:12 ` Mark H Weaver
2017-07-25 18:00 ` Leo Famulari
2017-08-27 22:36 ` Leo Famulari
2017-08-27 23:41 ` ng0
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).