packaging-committee

#1362 Require spec files to use https: URLs when possible.
Merged by james. Opened by rombobeorn.
rombobeorn/packaging-committee master  into  master

Download 1362.patch

HTTPS is now almost universally supported, and it's high time for spec files to stop using insecure HTTP and FTP in links to upstream websites. Even though those links aren't used directly in the package build process, spec files shouldn't instruct other tools or humans to use insecure protocols when HTTPS is available. Even if servers redirect bare HTTP requests to HTTPS, that can only happen after attackers have had the chance to redirect the request to a malicious server. There's no need to give attackers that opportunity.

A policy to require authentication is the logical first step. I expect that an effort to update existing spec files will be necessary later.

:thumbsup:

This seems reasonable. +1

Hm ... is "authentication" really the best word here? "HTTP authentication" is something different.

"transport encryption" is the correct phrase here.

Secrecy isn't the goal here. These URLs normally point to public resources that anyone can request, so encryption for secrecy isn't really important.

The point is to ensure that the server really is the upstream server and not an attacker providing a malicious source tarball. The client shall use the server's certificate to verify the server's identity. That is authentication. I wrote "authentication of the server" to make it clear that it's not about authenticating the client.

Transport encryption without authentication is technically possible, but that's not what we want.

Yes it is. Authentication (in the HTTP sense) is not possible for our tooling.
Edited by ngompa

This is about authentication in the TLS sense, not in the HTTP sense. A URL that begins with "https:" tells the client to use Transport Layer Security to check that the server is who it claims to be.

Note that URLs in the Patch tags should probably also use https.

I don't think I've ever seen a URL in Patch, but if that occurs then I agree that the same rule should apply there. Thanks.

1 new commit added

  • URLs in Patch tags should also use https:.

+1

Pull-Request has been merged by james
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.