tell ActiveState to fix their download links for ActivePerl to be https #2414

New Issue

tahoe-lafs · 2015-05-01T19:50:44Z

daira commented

2015-05-01 19:50:44 +00:00

This affects building pyOpenSSL (see source:docs/build/build-pyOpenSSL.rst).

I sent this message via https://www.activestate.com/company/contact-us :

At https://www.activestate.com/activeperl/downloads there are two download links for ActivePerl. They download from http URLs, even though the files are available over https. This is unnecessarily insecure (and affects the security of build processes for other software dependent on ActivePerl).

For example, the link to
https://www.activestate.com/activeperl/downloads/thank-you?dl=http://downloads.activestate.com/ActivePerl/releases/5.20.2.2001/ActivePerl-5.20.2.2001-MSWin32-x86-64int-298913.msi
should instead be
https://www.activestate.com/activeperl/downloads/thank-you?dl=https://downloads.activestate.com/ActivePerl/releases/5.20.2.2001/ActivePerl-5.20.2.2001-MSWin32-x86-64int-298913.msi

Please fix it, so that I don't have to tell people to manually change the link! Thanks.

I'll leave this ticket open until they've responded.

This affects building pyOpenSSL (see source:docs/build/build-pyOpenSSL.rst). I sent this message via <https://www.activestate.com/company/contact-us> : ---- At <https://www.activestate.com/activeperl/downloads> there are two download links for ActivePerl. They download from http URLs, even though the files are available over https. This is unnecessarily insecure (and affects the security of build processes for other software dependent on ActivePerl). For example, the link to <https://www.activestate.com/activeperl/downloads/thank-you?dl=http://downloads.activestate.com/ActivePerl/releases/5.20.2.2001/ActivePerl-5.20.2.2001-MSWin32-x86-64int-298913.msi> should instead be <https://www.activestate.com/activeperl/downloads/thank-you?dl=https://downloads.activestate.com/ActivePerl/releases/5.20.2.2001/ActivePerl-5.20.2.2001-MSWin32-x86-64int-298913.msi> Please fix it, so that I don't have to tell people to manually change the link! Thanks. ---- I'll leave this ticket open until they've responded.

tahoe-lafs added the

labels 2015-05-01 19:50:44 +00:00

tahoe-lafs added this to the soon (release n/a) milestone 2015-05-01 19:50:44 +00:00

daira commented

2015-05-23 18:17:04 +00:00

I received this reply:

Daira,

Webops has replied to the bug.

Changing the contents of that particular page would be misleading. Reason?
The downloads are not actually available via https. All requests to https:/downloads.activestate.com are redirected on the backend to http:/downloads.activestate.com, so the link is actually correct.

Manually changing the links on your end isn't having the effect you expect.

Best regards,

Graham Stuart
Technical Support Engineer
ActiveState - Code to Cloud: Smarter, Safer, Faster.
http://www.ActiveState.com

I received this reply: > Daira, > > Webops has replied to the bug. > > Changing the contents of that particular page would be misleading. Reason? > The downloads are not actually available via https. All requests to https:/downloads.activestate.com are redirected on the backend to http:/downloads.activestate.com, so the link is actually correct. > > Manually changing the links on your end isn't having the effect you expect. > > Best regards, > > Graham Stuart > Technical Support Engineer > ActiveState - Code to Cloud: Smarter, Safer, Faster. > <http://www.ActiveState.com>

daira commented

2015-05-23 18:22:50 +00:00

I responded:

Well, this is unfortunate. If it isn't fixed then we will have to switch to using some other Perl implementation, since the security of our build process is critical to us.

I responded: > Well, this is unfortunate. If it isn't fixed then we will have to switch to using some other Perl implementation, since the security of our build process is critical to us.

warner commented

2016-03-26 23:34:36 +00:00

The pyca folks are now providing binary wheels for cryptography, which is what actually links against libssl these days. The pyopenssl package is pure-python.

Does that make this Somebody Else's Problem? Specifically, is it now pyca's reponsibility to fetch these SSL things safely?

The pyca folks are now providing binary wheels for `cryptography`, which is what actually links against libssl these days. The `pyopenssl` package is pure-python. Does that make this Somebody Else's Problem? Specifically, is it now pyca's reponsibility to fetch these SSL things safely?

exarkun commented

2020-01-21 20:57:12 +00:00

Fortunately ActivePerl is no longer required in order to install pyOpenSSL.

Fortunately [ActivePerl](wiki/ActivePerl) is no longer required in order to install pyOpenSSL.

exarkun added the

was already fixed

label 2020-01-21 20:57:12 +00:00

exarkun closed this issue

2020-01-21 20:57:12 +00:00

Sign in to join this conversation.