mainSavannah Administration - Support: sr #109219, When downloading from HTTPS, user...

 
 

sr #109219: When downloading from HTTPS, user should not be redirected to HTTP mirrors

Submitter:  Luke <gaming4jc>
Submitted:  Sat 14 Jan 2017 03:15:23 AM UTC
   
 
Category:  Savannah website Priority:  5 - Normal
Severity:  4 - Important Status:  Postponed
Privacy:  Public Assigned to:  agn
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 26 Apr 2017 03:17:01 AM UTC, comment #2: 

Hello,

I've added this idea to our "savannah hacking ideas" page
( https://savannah.gnu.org/maintenance/SavannahHackingIdeas/ , item #31 ).

If there are volunteers that wish to help with implementing this feature,
please write to -email is unavailable-
and we'll gladly share the mirroring scripts and help with testing.

For now, I'm closing this item.

regards,
 - assaf

Assaf Gordon <agn>
Site Administrator
Sat 14 Jan 2017 03:24:57 AM UTC, comment #1: 

Hello,

Thanks for raising this issue.

We are in the process of migrating savannah's servers to new VMs,
and the mirrors will be part of this migration.

The mirroring mechanism is being rewritten, so I'll definitely keep this in mind and hope to have it working properly on the new servers.

regards,
 - assaf

Assaf Gordon <agn>
Site Administrator
Sat 14 Jan 2017 03:15:23 AM UTC, original submission:  

Hello,
I am attempting to download from HTTPS. However, when I try to reach any project I am redirected to a number of random mirrors.

Take for example: https://download.savannah.gnu.org/releases/attr

Most of these mirrors are running http. This is not good for security, especially on public networks.

I see several solutions to this problem.
1) Rewrite rule, if user is coming from HTTPS, send to HTTPS (would break mirrors without HTTPS support)
2) Enforce an HTTPS policy across mirrors

Luke <gaming4jc>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by agn (Posted a comment)
  • -email is unavailable- added by gaming4jc (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-04-26 agn StatusNone Postponed
        Open/ClosedOpen Closed
    2017-01-14 agn Assigned toNone agn

    Back to the top

    Powered by Savane 3.13-c373.
    Corresponding source code