Re: [PATCH] Replace git:// and http:// with https://

[Elliott Mitchell <ehem+xen@xxxxxxx>]

On Mon, Feb 06, 2023 at 10:10:33PM -0500, Demi Marie Obenour wrote:
> Obtaining code over an insecure transport is a terrible idea for
> blatently obvious reasons.  Even for non-executable data, insecure
> transports are considered deprecated.

I completely agree with the premise, but I would suggest the better
approach to removing use of git:// is to instead require signing of
commits.  I'm also under the impression git can use TLS, though I'm
unsure whether gits:// works (and what revision of git is required).


-- 
(\___(\___(\______          --=> 8-) EHM <=--          ______/)___/)___/)
 \BS (    |         ehem+sigmsg@xxxxxxx  PGP 87145445         |    )   /
  \_CS\   |  _____  -O #include <stddisclaimer.h> O-   _____  |   /  _/
8A19\___\_|_/58D2 7E3D DDF4 7BA6 <-PGP-> 41D1 B375 37D0 8714\_|_/___/5445