[PATCH] gnu: emacs: Use https for elpa.gnu.org

[PATCH] gnu: emacs: Use https for elpa.gnu.org

[ng0]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: 0001-gnu-emacs-Use-https-for-elpa.gnu.org.patch --]
[-- Type: text/x-patch, Size: 5247 bytes --]

From d2dfd0fcc34f5cdcb9d181093cffd5af16be6641 Mon Sep 17 00:00:00 2001
From: ng0 <ng0@we.make.ritual.n0.is>
Date: Sat, 27 Aug 2016 13:33:31 +0000
Subject: [PATCH 1/4] gnu: emacs: Use https for elpa.gnu.org.

* gnu/packages/emacs.scm: Use 'https' for all elpa.gnu.org urls.
---
 gnu/packages/emacs.scm | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
index 4fe9a8a..d1d8af0 100644
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@@ -652,7 +652,7 @@ programs.")
     (version "1.0.4")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://elpa.gnu.org/packages/let-alist-"
+              (uri (string-append "https://elpa.gnu.org/packages/let-alist-"
                                   version ".el"))
               (sha256
                (base32
@@ -681,7 +681,7 @@ programs.")
                      (emacs-byte-compile-directory lispdir)
                      #t))))
     (native-inputs `(("emacs" ,emacs-minimal)))
-    (home-page "http://elpa.gnu.org/packages/let-alist.html")
+    (home-page "https://elpa.gnu.org/packages/let-alist.html")
     (synopsis "Easily let-bind values of an assoc-list by their names")
     (description
      "This package offers a single Emacs Lisp macro, @code{let-alist}.  This
@@ -1038,13 +1038,13 @@ mode, Rmail, Gnus, MH-E, and VM).  BBDB is fully customizable.")
     (version "1.9")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://elpa.gnu.org/packages/async-"
+              (uri (string-append "https://elpa.gnu.org/packages/async-"
                                   version ".tar"))
               (sha256
                (base32
                 "1ip5nc8xyln5szvqwp6wqva9xr84pn8ssn3nnphrszr19y4js2bm"))))
     (build-system emacs-build-system)
-    (home-page "http://elpa.gnu.org/packages/async.html")
+    (home-page "https://elpa.gnu.org/packages/async.html")
     (synopsis "Asynchronous processing in Emacs")
     (description
      "This package provides the ability to call asynchronous functions and
@@ -1061,7 +1061,7 @@ as a library for other Emacs packages.")
      (origin
        (method url-fetch)
        (uri (string-append
-             "http://elpa.gnu.org/packages/auctex-"
+             "https://elpa.gnu.org/packages/auctex-"
              version
              ".tar"))
        (sha256
@@ -1619,7 +1619,7 @@ source code using IPython.")
     (version "0.9")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://elpa.gnu.org/packages/debbugs-"
+              (uri (string-append "https://elpa.gnu.org/packages/debbugs-"
                                   version ".tar"))
               (sha256
                (base32
@@ -1627,7 +1627,7 @@ source code using IPython.")
     (build-system emacs-build-system)
     (propagated-inputs
      `(("emacs-async" ,emacs-async)))
-    (home-page "http://elpa.gnu.org/packages/debbugs.html")
+    (home-page "https://elpa.gnu.org/packages/debbugs.html")
     (synopsis "Access the Debbugs bug tracker in Emacs")
     (description
      "This package lets you access the @uref{http://bugs.gnu.org,GNU Bug
@@ -2099,7 +2099,7 @@ package provides a light and a dark variant.")
     (version "1.3.0")
     (source
      (origin (method url-fetch)
-             (uri (string-append "http://elpa.gnu.org/packages/ahungry-theme-"
+             (uri (string-append "https://elpa.gnu.org/packages/ahungry-theme-"
                                  version ".tar"))
              (sha256
               (base32
@@ -2405,7 +2405,7 @@ The purpose of this library is to wrap all the quirks and hassle of
     (version "0.1.1")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://elpa.gnu.org/packages/queue-"
+              (uri (string-append "https://elpa.gnu.org/packages/queue-"
                                   version ".el"))
               (sha256
                (base32
@@ -2448,7 +2448,7 @@ be removed from the front.  This type of data structure is sometimes called an
     (version "1.7.1")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://elpa.gnu.org/packages/spinner-"
+              (uri (string-append "https://elpa.gnu.org/packages/spinner-"
                                   version ".el"))
               (sha256
                (base32
@@ -2467,13 +2467,13 @@ ongoing operations.")
     (version "2.15")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://elpa.gnu.org/packages/seq-"
+              (uri (string-append "https://elpa.gnu.org/packages/seq-"
                                   version ".tar"))
               (sha256
                (base32
                 "09wi1765bmn7i8fg6ajjfaxgs4ipc42d58zx2fdqpidrdg9c7q73"))))
     (build-system emacs-build-system)
-    (home-page "http://elpa.gnu.org/packages/seq.html")
+    (home-page "https://elpa.gnu.org/packages/seq.html")
     (synopsis "Sequence manipulation functions for Emacs")
     (description
      "This Emacs library provides sequence-manipulation functions that
-- 
2.9.3


[-- Attachment #2: Type: text/plain, Size: 70 bytes --]


-- 
ng0
For non-prism friendly talk find me on http://www.psyced.org

Re: [PATCH] gnu: emacs: Use https for elpa.gnu.org

[Alex Kost]

ng0 (2016-08-27 17:20 +0300) wrote:

> From d2dfd0fcc34f5cdcb9d181093cffd5af16be6641 Mon Sep 17 00:00:00 2001
> From: ng0 <ng0@we.make.ritual.n0.is>
> Date: Sat, 27 Aug 2016 13:33:31 +0000
> Subject: [PATCH 1/4] gnu: emacs: Use https for elpa.gnu.org.
>
> * gnu/packages/emacs.scm: Use 'https' for all elpa.gnu.org urls.
> ---
>  gnu/packages/emacs.scm | 24 ++++++++++++------------
>  1 file changed, 12 insertions(+), 12 deletions(-)
>
>
> diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
> index 4fe9a8a..d1d8af0 100644
> --- a/gnu/packages/emacs.scm
> +++ b/gnu/packages/emacs.scm
> @@ -652,7 +652,7 @@ programs.")
>      (version "1.0.4")
>      (source (origin
>                (method url-fetch)
> -              (uri (string-append "http://elpa.gnu.org/packages/let-alist-"
> +              (uri (string-append "https://elpa.gnu.org/packages/let-alist-"
>                                    version ".el"))

FYI 'let-alist' was added by Ludovic, and I think using "http" was
intentional.  I asked once about "https" vs. "http", and I'm not sure
whether these http→https changes are desired:

http://lists.gnu.org/archive/html/guix-devel/2015-07/msg00378.html

-- 
Alex

Re: [PATCH] gnu: emacs: Use https for elpa.gnu.org

[ng0]

Alex Kost <alezost@gmail.com> writes:

> ng0 (2016-08-27 17:20 +0300) wrote:
>
>> From d2dfd0fcc34f5cdcb9d181093cffd5af16be6641 Mon Sep 17 00:00:00 2001
>> From: ng0 <ng0@we.make.ritual.n0.is>
>> Date: Sat, 27 Aug 2016 13:33:31 +0000
>> Subject: [PATCH 1/4] gnu: emacs: Use https for elpa.gnu.org.
>>
>> * gnu/packages/emacs.scm: Use 'https' for all elpa.gnu.org urls.
>> ---
>>  gnu/packages/emacs.scm | 24 ++++++++++++------------
>>  1 file changed, 12 insertions(+), 12 deletions(-)
>>
>>
>> diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
>> index 4fe9a8a..d1d8af0 100644
>> --- a/gnu/packages/emacs.scm
>> +++ b/gnu/packages/emacs.scm
>> @@ -652,7 +652,7 @@ programs.")
>>      (version "1.0.4")
>>      (source (origin
>>                (method url-fetch)
>> -              (uri (string-append "http://elpa.gnu.org/packages/let-alist-"
>> +              (uri (string-append "https://elpa.gnu.org/packages/let-alist-"
>>                                    version ".el"))
>
> FYI 'let-alist' was added by Ludovic, and I think using "http" was
> intentional.  I asked once about "https" vs. "http", and I'm not sure
> whether these http→https changes are desired:
>
> http://lists.gnu.org/archive/html/guix-devel/2015-07/msg00378.html

I share this position although it is a very short statement for a
complex topic. Using tls in combination with for example the extension
certificate patrol for firefox based browsers helps to control
certificates and catch bad ones.

Does hydra pull packages via tor? Is our default tor? No. As long as we
have no alternative, like the one I work towards to, we should use the
minimal bit of authenticity tls can provide.
-- 
ng0
For non-prism friendly talk find me on http://www.psyced.org

Re: [PATCH] gnu: emacs: Use https for elpa.gnu.org

[ng0]

ng0 <ng0@we.make.ritual.n0.is> writes:

> Alex Kost <alezost@gmail.com> writes:
>
>> ng0 (2016-08-27 17:20 +0300) wrote:
>>
>>> From d2dfd0fcc34f5cdcb9d181093cffd5af16be6641 Mon Sep 17 00:00:00 2001
>>> From: ng0 <ng0@we.make.ritual.n0.is>
>>> Date: Sat, 27 Aug 2016 13:33:31 +0000
>>> Subject: [PATCH 1/4] gnu: emacs: Use https for elpa.gnu.org.
>>>
>>> * gnu/packages/emacs.scm: Use 'https' for all elpa.gnu.org urls.
>>> ---
>>>  gnu/packages/emacs.scm | 24 ++++++++++++------------
>>>  1 file changed, 12 insertions(+), 12 deletions(-)
>>>
>>>
>>> diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
>>> index 4fe9a8a..d1d8af0 100644
>>> --- a/gnu/packages/emacs.scm
>>> +++ b/gnu/packages/emacs.scm
>>> @@ -652,7 +652,7 @@ programs.")
>>>      (version "1.0.4")
>>>      (source (origin
>>>                (method url-fetch)
>>> -              (uri (string-append "http://elpa.gnu.org/packages/let-alist-"
>>> +              (uri (string-append "https://elpa.gnu.org/packages/let-alist-"
>>>                                    version ".el"))
>>
>> FYI 'let-alist' was added by Ludovic, and I think using "http" was
>> intentional.  I asked once about "https" vs. "http", and I'm not sure
>> whether these http→https changes are desired:
>>
>> http://lists.gnu.org/archive/html/guix-devel/2015-07/msg00378.html
>
> I share this position although it is a very short statement for a
> complex topic. Using tls in combination with for example the extension
> certificate patrol for firefox based browsers helps to control
> certificates and catch bad ones.
>
> Does hydra pull packages via tor? Is our default tor? No. As long as we
> have no alternative, like the one I work towards to, we should use the
> minimal bit of authenticity tls can provide.

Adding to this: in some countries, using tor is dangerous, illegal and
the opposition can face severe sentences by the government in charge of
the country. It makes more sense to use tls, even when it is broken,
than to say 'just use tor'. We add security on top of that through hash
and checksums, but having a default of tls is safer in my opinion, for
the moment.
-- 
ng0
For non-prism friendly talk find me on http://www.psyced.org

Re: [PATCH] gnu: emacs: Use https for elpa.gnu.org

[ng0]

Hi,

can someone else comment on this thread? I've listed part of my reasons,
not all, my position should be clear.

ng0 <ng0@we.make.ritual.n0.is> writes:

> ng0 <ng0@we.make.ritual.n0.is> writes:
>
>> Alex Kost <alezost@gmail.com> writes:
>>
>>> ng0 (2016-08-27 17:20 +0300) wrote:
>>>
>>>> From d2dfd0fcc34f5cdcb9d181093cffd5af16be6641 Mon Sep 17 00:00:00 2001
>>>> From: ng0 <ng0@we.make.ritual.n0.is>
>>>> Date: Sat, 27 Aug 2016 13:33:31 +0000
>>>> Subject: [PATCH 1/4] gnu: emacs: Use https for elpa.gnu.org.
>>>>
>>>> * gnu/packages/emacs.scm: Use 'https' for all elpa.gnu.org urls.
>>>> ---
>>>>  gnu/packages/emacs.scm | 24 ++++++++++++------------
>>>>  1 file changed, 12 insertions(+), 12 deletions(-)
>>>>
>>>>
>>>> diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
>>>> index 4fe9a8a..d1d8af0 100644
>>>> --- a/gnu/packages/emacs.scm
>>>> +++ b/gnu/packages/emacs.scm
>>>> @@ -652,7 +652,7 @@ programs.")
>>>>      (version "1.0.4")
>>>>      (source (origin
>>>>                (method url-fetch)
>>>> -              (uri (string-append "http://elpa.gnu.org/packages/let-alist-"
>>>> +              (uri (string-append "https://elpa.gnu.org/packages/let-alist-"
>>>>                                    version ".el"))
>>>
>>> FYI 'let-alist' was added by Ludovic, and I think using "http" was
>>> intentional.  I asked once about "https" vs. "http", and I'm not sure
>>> whether these http→https changes are desired:
>>>
>>> http://lists.gnu.org/archive/html/guix-devel/2015-07/msg00378.html
>>
>> I share this position although it is a very short statement for a
>> complex topic. Using tls in combination with for example the extension
>> certificate patrol for firefox based browsers helps to control
>> certificates and catch bad ones.
>>
>> Does hydra pull packages via tor? Is our default tor? No. As long as we
>> have no alternative, like the one I work towards to, we should use the
>> minimal bit of authenticity tls can provide.
>
> Adding to this: in some countries, using tor is dangerous, illegal and
> the opposition can face severe sentences by the government in charge of
> the country. It makes more sense to use tls, even when it is broken,
> than to say 'just use tor'. We add security on top of that through hash
> and checksums, but having a default of tls is safer in my opinion, for
> the moment.
> -- 
> ng0
> For non-prism friendly talk find me on http://www.psyced.org
>

-- 
ng0
For non-prism friendly talk find me on http://www.psyced.org

Re: [PATCH] gnu: emacs: Use https for elpa.gnu.org

[Alex Kost]

ng0 (2016-09-08 23:27 +0000) wrote:

> Hi,
>
> can someone else comment on this thread? I've listed part of my reasons,
> not all, my position should be clear.

Since your other similar patches (http->https) were committed, I don't
see a problem with this one, so if no one will object in a day or two,
I'm going to commit it :-)

-- 
Alex

Re: [PATCH] gnu: emacs: Use https for elpa.gnu.org

[Alex Kost]

Alex Kost (2016-09-09 21:04 +0300) wrote:

> ng0 (2016-09-08 23:27 +0000) wrote:
>
>> Hi,
>>
>> can someone else comment on this thread? I've listed part of my reasons,
>> not all, my position should be clear.
>
> Since your other similar patches (http->https) were committed, I don't
> see a problem with this one, so if no one will object in a day or two,
> I'm going to commit it :-)

Committed as f32ffa0.

-- 
Alex

Re: [PATCH] gnu: emacs: Use https for elpa.gnu.org

[Ludovic Courtès]

Alex Kost <alezost@gmail.com> skribis:

> Alex Kost (2016-09-09 21:04 +0300) wrote:
>
>> ng0 (2016-09-08 23:27 +0000) wrote:
>>
>>> Hi,
>>>
>>> can someone else comment on this thread? I've listed part of my reasons,
>>> not all, my position should be clear.
>>
>> Since your other similar patches (http->https) were committed, I don't
>> see a problem with this one, so if no one will object in a day or two,
>> I'm going to commit it :-)
>
> Committed as f32ffa0.

Thanks.  :-)

Ludo’.