[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v4 2/3] Build system: Replace git:// and http:// with https://
- To: Demi Marie Obenour <demi@xxxxxxxxxxxxxxxxxxxxxx>
- From: Jan Beulich <jbeulich@xxxxxxxx>
- Date: Mon, 27 Feb 2023 09:25:32 +0100
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=suse.com; dmarc=pass action=none header.from=suse.com; dkim=pass header.d=suse.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Sfyl7/Y7lDf78h9hLB+9Q/6fx14q15njNB5cRcJb5/w=; b=CrZTGAyP4gl8uf7NTLiR4dAjRU5JbzmIIh5RER6woA8QKqKOa6KyxHYExlK+IJlPrZE02kpyuWzRak54F2KZpwUPqazFAh1KqnKFIKTJDCDyJYu+yL+wW83+XDJE0b/28jxIAyC4QHffvvZ1iGXvCJ7XO1q7yV1z3P1XqfOAqZWGybT2TT3T7bajnMgiuT7vRii7HKJFh/KR/SZtRQTAni0mtuo7L84hZ+vbOCxcgTq2rDM+GBtb1Ikv+7IksJZod+D/V3JeVXb1fYH5US12YVqvc8S1rBWPEcK1ETg+UAT26HoEKQc5PlvwMkQapVV0rrQZr0371mdVVHGF//cbIg==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=AwnAhwEEnhFb76I7BwZf9s6xyExVNndeAvydKlIHMi9+5EqMfsb+gjZ3s6CLJaIuFBiZBRB+d0dT5k9eI1YUtMonkSUEEE031Usx15AU7UA5lNGtHv5V+hP0tu2fD24bxRQr0ZNLGQ+9CVTE9adTmFhn+i6yu7N4gu9zc+oif/lkORHxClc5TVo93PfS6agiO6dHt+3TJSbZLC0ncL0zTQHH9q+1hZ7cGtSX0FYANCS0XdqESiHHmPRyuSKhv1jm72quu2Dbo63R0WFAIXqIq9tnMxDwZ1YIVDWGF1NtFUC1R38yIBGYTALY+DT1iDTBFRN0CrrGyROvLdR9VgVBRQ==
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=suse.com;
- Cc: Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, George Dunlap <george.dunlap@xxxxxxxxxx>, Julien Grall <julien@xxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Wei Liu <wl@xxxxxxx>, Samuel Thibault <samuel.thibault@xxxxxxxxxxxx>, Anthony PERARD <anthony.perard@xxxxxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxxx
- Delivery-date: Mon, 27 Feb 2023 08:26:03 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 24.02.2023 23:55, Demi Marie Obenour wrote:
> On Tue, Feb 21, 2023 at 11:07:58AM +0100, Jan Beulich wrote:
>> On 19.02.2023 03:46, Demi Marie Obenour wrote:
>>> --- a/stubdom/configure
>>> +++ b/stubdom/configure
>>> @@ -3535,7 +3535,7 @@ if test "x$ZLIB_URL" = "x"; then :
>>> if test "x$extfiles" = "xy"; then :
>>> ZLIB_URL=\$\(XEN_EXTFILES_URL\)
>>> else
>>> - ZLIB_URL="http://www.zlib.net";
>>> + ZLIB_URL="https://www.zlib.net";
>>> fi
>>
>> In v3 you said that this URL can't be used anymore for the version we're
>> trying to fetch (which I can confirm). Leaving aside the question of why
>> stubdom was never updated in that regard, what use is it to update URL
>> (without even mentioning the aspect in the description) in such a case?
>> (I haven't gone through any of the other URLs again, so there may well
>> be more similar cases.)
>
> Main advantage is that it will fail securely rather than downloading
> whatever random code an MITM attacker put in there.
As said before (and implied here): At the very least you need to mention
the aspect in the description. But then wouldn't things be failing equally
securely if no (non-working) URL was put in place, or one which is
guaranteed to yield an error but makes obvious that no real URL is meant?
Jan
|
