| Message ID | 20260427103040.1519121-1-viswanath.kraleti@oss.qualcomm.com |
|---|---|
| State | Accepted, archived |
| Commit | 9ed100e49a28eb163a4f8321ff3476ac7c58cc73 |
| Headers | show |
| Series | mirrors: switch Yocto Project mirrors to HTTPS | expand |
On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via lists.openembedded.org wrote: [...] > svn://.*/.* http://sources.openembedded.org/ \ > git://.*/.* http://sources.openembedded.org/ \ > gitsm://.*/.* http://sources.openembedded.org/ \ On a related note, it seems that http://sources.openembedded.org/ is no longer active. Could we remove it? Antonin
Antonin Godard via lists.openembedded.org <antonin.godard= bootlin.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 12:40): > On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via > lists.openembedded.org wrote: > [...] > > svn://.*/.* http://sources.openembedded.org/ \ > > git://.*/.* http://sources.openembedded.org/ \ > > gitsm://.*/.* http://sources.openembedded.org/ \ > > On a related note, it seems that http://sources.openembedded.org/ is no > longer > active. Could we remove it? > I also noticed that when I tried it, but I was unsure if it was intermittent or if it didn't even exist. Add Michael in cc and perhaps he can confirm. Jose > > Antonin > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#236007): > https://lists.openembedded.org/g/openembedded-core/message/236007 > Mute This Topic: https://lists.openembedded.org/mt/119028000/5052612 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [ > quaresma.jose@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > >
Jose Quaresma via lists.openembedded.org <quaresma.jose= gmail.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 15:09): > > > Antonin Godard via lists.openembedded.org <antonin.godard= > bootlin.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) > 12:40): > >> On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via >> lists.openembedded.org wrote: >> [...] >> > svn://.*/.* http://sources.openembedded.org/ \ >> > git://.*/.* http://sources.openembedded.org/ \ >> > gitsm://.*/.* http://sources.openembedded.org/ \ >> >> On a related note, it seems that http://sources.openembedded.org/ is no >> longer >> active. Could we remove it? >> > > I also noticed that when I tried it, but I was unsure if it was > intermittent or if it didn't even exist. > Add Michael in cc and perhaps he can confirm. > It's not intermittent, because the address still can't be resolved today. I think it's safe to remove this addresses in a subsequent commit, and if there are any complaints, we can revert the commit. Jose > Jose > > >> >> Antonin >> >> >> >> > > -- > Best regards, > > José Quaresma > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#236012): > https://lists.openembedded.org/g/openembedded-core/message/236012 > Mute This Topic: https://lists.openembedded.org/mt/119028000/5052612 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [ > quaresma.jose@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > >
On Tue, 2026-04-28 at 11:46 +0100, Jose Quaresma via lists.openembedded.org wrote: > > > Jose Quaresma via lists.openembedded.org <quaresma.jose=gmail.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 15:09): > > > > > > Antonin Godard via lists.openembedded.org <antonin.godard=bootlin.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 12:40): > > > On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via lists.openembedded.org wrote: > > > [...] > > > > svn://.*/.* http://sources.openembedded.org/ \ > > > > git://.*/.* http://sources.openembedded.org/ \ > > > > gitsm://.*/.* http://sources.openembedded.org/ \ > > > > > > On a related note, it seems that http://sources.openembedded.org/ is no longer > > > active. Could we remove it? > > > > > > > > > I also noticed that when I tried it, but I was unsure if it was intermittent or if it didn't even exist. > > Add Michael in cc and perhaps he can confirm. > > > > > It's not intermittent, because the address still can't be resolved today. > I think it's safe to remove this addresses in a subsequent commit, > and if there are any complaints, we can revert the commit. I know a bit of the history there and agree we should remove them. Cheers, Richard
On Mon, 2026-04-27 at 16:00 +0530, Viswanath Kraleti via lists.openembedded.org wrote: > downloads.yoctoproject.org supports access over HTTPS, which provides > better security and reliability than HTTP. > > Switch the default Yocto Project mirror URLs to use HTTPS instead of > HTTP to improve fetch reliability. > > Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com> I'm not going to fight against the current on this one but keep in mind we checksum/verify anything we download, so http vs https doesn't actually matter as much as people think here. What we did used to care about more was the load on the server of https vs http. I'm therefore not convinced about reliability or security. Cheers, Richard
On Tue, Apr 28, 2026 at 4:53 PM Richard Purdie <richard.purdie@linuxfoundation.org> wrote: > > On Tue, 2026-04-28 at 11:46 +0100, Jose Quaresma via lists.openembedded.org wrote: > > > > > > Jose Quaresma via lists.openembedded.org <quaresma.jose=gmail.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 15:09): > > > > > > > > > Antonin Godard via lists.openembedded.org <antonin.godard=bootlin.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 12:40): > > > > On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via lists.openembedded.org wrote: > > > > [...] > > > > > svn://.*/.* http://sources.openembedded.org/ \ > > > > > git://.*/.* http://sources.openembedded.org/ \ > > > > > gitsm://.*/.* http://sources.openembedded.org/ \ > > > > > > > > On a related note, it seems that http://sources.openembedded.org/ is no longer > > > > active. Could we remove it? > > > > > > > > > > > > > I also noticed that when I tried it, but I was unsure if it was intermittent or if it didn't even exist. > > > Add Michael in cc and perhaps he can confirm. > > > > > > > > > It's not intermittent, because the address still can't be resolved today. > > I think it's safe to remove this addresses in a subsequent commit, > > and if there are any complaints, we can revert the commit. > > I know a bit of the history there and agree we should remove them. > Thanks for the confirmation. I'll drop them. > Cheers, > > Richard
On Tue Apr 28, 2026 at 2:01 PM CEST, Viswanath Kraleti wrote: > On Tue, Apr 28, 2026 at 4:53 PM Richard Purdie > <richard.purdie@linuxfoundation.org> wrote: >> >> On Tue, 2026-04-28 at 11:46 +0100, Jose Quaresma via lists.openembedded.org wrote: >> > >> > >> > Jose Quaresma via lists.openembedded.org <quaresma.jose=gmail.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 15:09): >> > > >> > > >> > > Antonin Godard via lists.openembedded.org <antonin.godard=bootlin.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 12:40): >> > > > On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via lists.openembedded.org wrote: >> > > > [...] >> > > > > svn://.*/.* http://sources.openembedded.org/ \ >> > > > > git://.*/.* http://sources.openembedded.org/ \ >> > > > > gitsm://.*/.* http://sources.openembedded.org/ \ >> > > > >> > > > On a related note, it seems that http://sources.openembedded.org/ is no longer >> > > > active. Could we remove it? >> > > > >> > > >> > > >> > > I also noticed that when I tried it, but I was unsure if it was intermittent or if it didn't even exist. >> > > Add Michael in cc and perhaps he can confirm. >> > > >> > >> > >> > It's not intermittent, because the address still can't be resolved today. >> > I think it's safe to remove this addresses in a subsequent commit, >> > and if there are any complaints, we can revert the commit. >> >> I know a bit of the history there and agree we should remove them. >> > > Thanks for the confirmation. I'll drop them. Sorry I forgot to cc you. I just sent a patch: https://lore.kernel.org/r/20260428-remove-sources-openembedded-mirrors-v1-1-dbaea026dcdf@bootlin.com Antonin
On Tue, Apr 28, 2026 at 5:06 PM Richard Purdie <richard.purdie@linuxfoundation.org> wrote: > > On Mon, 2026-04-27 at 16:00 +0530, Viswanath Kraleti via lists.openembedded.org wrote: > > downloads.yoctoproject.org supports access over HTTPS, which provides > > better security and reliability than HTTP. > > > > Switch the default Yocto Project mirror URLs to use HTTPS instead of > > HTTP to improve fetch reliability. > > > > Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com> > > I'm not going to fight against the current on this one but keep in mind > we checksum/verify anything we download, so http vs https doesn't > actually matter as much as people think here. > > What we did used to care about more was the load on the server of https > vs http. I'm therefore not convinced about reliability or security. > At least in my organization, accessing http servers from behind a firewall is considered insecure and is subject to restrictions and audits. I suspect many other workplaces follow similar practices. Since the server already supports https, which is generally accepted, switching to it seems like a better approach. Please let me know if you think otherwise. If needed, I can reword the commit message to clarify that this change is primarily about aligning with best practices, rather than introducing any reliability or security. > Cheers, > > Richard > > > > >
diff --git a/meta/classes-global/mirrors.bbclass b/meta/classes-global/mirrors.bbclass index c8ceb9f5c4..c6092a6f41 100644 --- a/meta/classes-global/mirrors.bbclass +++ b/meta/classes-global/mirrors.bbclass @@ -29,13 +29,13 @@ ${SAVANNAH_NONGNU_MIRROR} http://download-mirror.savannah.nongnu.org/releases \ ftp://sourceware.org/pub http://mirrors.edge.kernel.org/sourceware \ ftp://sourceware.org/pub http://gd.tuwien.ac.at/gnu/sourceware \ ftp://sourceware.org/pub http://ftp.gwdg.de/pub/linux/sources.redhat.com/sourceware \ -svn://.*/.* http://downloads.yoctoproject.org/mirror/sources/ \ -git://.*/.* http://downloads.yoctoproject.org/mirror/sources/ \ -gitsm://.*/.* http://downloads.yoctoproject.org/mirror/sources/ \ -hg://.*/.* http://downloads.yoctoproject.org/mirror/sources/ \ -https?://.*/.* http://downloads.yoctoproject.org/mirror/sources/ \ -ftp://.*/.* http://downloads.yoctoproject.org/mirror/sources/ \ -npm://.*/?.* http://downloads.yoctoproject.org/mirror/sources/ \ +svn://.*/.* https://downloads.yoctoproject.org/mirror/sources/ \ +git://.*/.* https://downloads.yoctoproject.org/mirror/sources/ \ +gitsm://.*/.* https://downloads.yoctoproject.org/mirror/sources/ \ +hg://.*/.* https://downloads.yoctoproject.org/mirror/sources/ \ +https?://.*/.* https://downloads.yoctoproject.org/mirror/sources/ \ +ftp://.*/.* https://downloads.yoctoproject.org/mirror/sources/ \ +npm://.*/?.* https://downloads.yoctoproject.org/mirror/sources/ \ svn://.*/.* http://sources.openembedded.org/ \ git://.*/.* http://sources.openembedded.org/ \ gitsm://.*/.* http://sources.openembedded.org/ \
downloads.yoctoproject.org supports access over HTTPS, which provides better security and reliability than HTTP. Switch the default Yocto Project mirror URLs to use HTTPS instead of HTTP to improve fetch reliability. Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com> --- meta/classes-global/mirrors.bbclass | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)