On the modern internet it is not credible to continue to advertize
software downloads over unencrypted connections. Even if users could
theoretically use GPG to verify the signatures, not all our downloads
and signed and few people know how to correctly verify signatures.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
docs/downloads.html.in | 61 ++++++++++++++----------------------------
1 file changed, 20 insertions(+), 41 deletions(-)
diff --git a/docs/downloads.html.in b/docs/downloads.html.in
index 657cd6a6f8..0722469eb9 100644
--- a/docs/downloads.html.in
+++ b/docs/downloads.html.in
@@ -27,8 +27,7 @@
<tr>
<td>libvirt</td>
<td>
- <a href="ftp://libvirt.org/libvirt/">ftp</a>
- <a href="https://libvirt.org/sources/">https</a>
+ <a href="https://libvirt.org/sources/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt.git;a=summary">libvirt</a>
@@ -48,8 +47,7 @@
<tr>
<td>C#</td>
<td>
- <a href="ftp://libvirt.org/libvirt/csharp/">ftp</a>
- <a href="https://libvirt.org/sources/csharp/">https</a>
+ <a href="https://libvirt.org/sources/csharp/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-csharp.git;a=summary">libvirt</a>
@@ -63,8 +61,7 @@
<tr>
<td>Go</td>
<td>
- <a href="ftp://libvirt.org/libvirt/go/">ftp</a>
- <a href="https://libvirt.org/sources/go/">https</a>
+ <a href="https://libvirt.org/sources/go/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-go.git;a=summary">libvirt</a>
@@ -80,8 +77,7 @@
<tr>
<td>Java</td>
<td>
- <a href="ftp://libvirt.org/libvirt/java/">ftp</a>
- <a href="https://libvirt.org/sources/java/">https</a>
+ <a href="https://libvirt.org/sources/java/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-java.git;a=summary">libvirt</a>
@@ -95,8 +91,7 @@
<tr>
<td>OCaml</td>
<td>
- <a href="ftp://libvirt.org/libvirt/ocaml/">ftp</a>
- <a href="https://libvirt.org/sources/ocaml/">https</a>
+ <a href="https://libvirt.org/sources/ocaml/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-ocaml.git;a=summary">libvirt</a>
@@ -127,8 +122,7 @@
<tr>
<td>PHP</td>
<td>
- <a href="ftp://libvirt.org/libvirt/php/">ftp</a>
- <a href="https://libvirt.org/sources/php/">https</a>
+ <a href="https://libvirt.org/sources/php/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-php.git;a=summary">libvirt</a>
@@ -142,8 +136,7 @@
<tr>
<td>Python</td>
<td>
- <a href="ftp://libvirt.org/libvirt/python/">ftp</a>
- <a href="https://libvirt.org/sources/python/">https</a>
+ <a href="https://libvirt.org/sources/python/">libvirt</a>
<a href="https://pypi.python.org/pypi/libvirt-python">pypi</a>
</td>
<td>
@@ -158,8 +151,7 @@
<tr>
<td>Ruby</td>
<td>
- <a href="ftp://libvirt.org/libvirt/ruby/">ftp</a>
- <a href="https://libvirt.org/sources/ruby/">https</a>
+ <a href="https://libvirt.org/sources/ruby/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=ruby-libvirt.git;a=summary">libvirt</a>
@@ -173,8 +165,7 @@
<tr>
<td>Rust</td>
<td>
- <a href="ftp://libvirt.org/libvirt/rust/">ftp</a>
- <a href="https://libvirt.org/sources/rust/">https</a>
+ <a href="https://libvirt.org/sources/rust/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-rust.git;a=summary">libvirt</a>
@@ -191,8 +182,7 @@
<tr>
<td>GLib / GConfig / GObject</td>
<td>
- <a href="ftp://libvirt.org/libvirt/glib/">ftp</a>
- <a href="https://libvirt.org/sources/glib/">https</a>
+ <a href="https://libvirt.org/sources/glib/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-glib.git;a=summary">libvirt</a>
@@ -206,8 +196,7 @@
<tr>
<td>Go XML</td>
<td>
- <a href="ftp://libvirt.org/libvirt/go/">ftp</a>
- <a href="https://libvirt.org/sources/go/">https</a>
+ <a href="https://libvirt.org/sources/go/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-go-xml.git;a=summary">libvirt</a>
@@ -223,8 +212,7 @@
<tr>
<td>D-Bus</td>
<td>
- <a href="ftp://libvirt.org/libvirt/dbus/">ftp</a>
- <a href="https://libvirt.org/sources/dbus/">https</a>
+ <a href="https://libvirt.org/sources/dbus/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-dbus.git;a=summary">libvirt</a>
@@ -238,8 +226,7 @@
<tr>
<td>Console Proxy</td>
<td>
- <a href="ftp://libvirt.org/libvirt/consoleproxy/">ftp</a>
- <a href="https://libvirt.org/sources/consoleproxy/">https</a>
+ <a href="https://libvirt.org/sources/consoleproxy/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-console-proxy.git;a=summary">libvirt</a>
@@ -253,8 +240,7 @@
<tr>
<td>CIM provider</td>
<td>
- <a href="ftp://libvirt.org/libvirt/CIM/">ftp</a>
- <a href="https://libvirt.org/sources/CIM/">https</a>
+ <a href="https://libvirt.org/sources/CIM/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-cim.git;a=summary">libvirt</a>
@@ -268,8 +254,7 @@
<tr>
<td>CIM utils</td>
<td>
- <a href="ftp://libvirt.org/libvirt/CIM/">ftp</a>
- <a href="https://libvirt.org/sources/CIM/">https</a>
+ <a href="https://libvirt.org/sources/CIM/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libcmpiutil.git;a=summary">libvirt</a>
@@ -283,8 +268,7 @@
<tr>
<td>SNMP</td>
<td>
- <a href="ftp://libvirt.org/libvirt/snmp/">ftp</a>
- <a href="https://libvirt.org/sources/snmp/">https</a>
+ <a href="https://libvirt.org/sources/snmp/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-snmp.git;a=summary">libvirt</a>
@@ -298,8 +282,7 @@
<tr>
<td>Application Sandbox</td>
<td>
- <a href="ftp://libvirt.org/libvirt/sandbox/">ftp</a>
- <a href="https://libvirt.org/sources/sandbox/">https</a>
+ <a href="https://libvirt.org/sources/sandbox/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-sandbox.git;a=summary">libvirt</a>
@@ -316,8 +299,7 @@
<tr>
<td>TCK</td>
<td>
- <a href="ftp://libvirt.org/libvirt/tck/">ftp</a>
- <a href="https://libvirt.org/sources/tck/">https</a>
+ <a href="https://libvirt.org/sources/tck/">libvirt</a>
</td>
<td>
<a href="https://libvirt.org/git/?p=libvirt-tck.git;a=summary">libvirt</a>
@@ -422,14 +404,11 @@
<p>
Most modules have releases made available for download on the project
- site, via FTP, HTTP or HTTPS. Some modules are instead made available
- at alternative locations, for example, the Perl binding is made
- available only on CPAN.
+ site via HTTPS. Some modules are instead made available at alternative
+ locations, for example, the Perl binding is made available only on CPAN.
</p>
<ul>
- <li><a href="ftp://libvirt.org/libvirt/">libvirt.org FTP server</a></li>
- <li><a href="https://libvirt.org/sources/">libvirt.org HTTP server</a></li>
<li><a href="https://libvirt.org/sources/">libvirt.org HTTPS server</a></li>
</ul>
--
2.20.1
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-listOn Wed, 2019-04-03 at 16:42 +0100, Daniel P. Berrangé wrote: > docs: stop advertizing FTP or HTTP for downloads of libvirt We never advertised HTTP downloads, we only had an HTTPS URL incorrectly labeled as "HTTP". So s/or HTTP // in the subject. > On the modern internet it is not credible to continue to advertize > software downloads over unencrypted connections. Even if users could > theoretically use GPG to verify the signatures, not all our downloads > and signed s/and/are/ Also, is that so? We should fix that. [...] > @@ -27,8 +27,7 @@ > <tr> > <td>libvirt</td> > <td> > - <a href="ftp://libvirt.org/libvirt/">ftp</a> > - <a href="https://libvirt.org/sources/">https</a> > + <a href="https://libvirt.org/sources/">libvirt</a> That's... A whole lot of "libvirt"s in the page after the change. I don't have brilliant ideas on how to improve upon that, though. Perhaps use "libvirt.org" instead of "libvirt"? Food for thought. For the time being, with the commit message fixed Reviewed-by: Andrea Bolognani <abologna@redhat.com> -- Andrea Bolognani / Red Hat / Virtualization -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list
On Thu, Apr 04, 2019 at 10:51:22AM +0200, Andrea Bolognani wrote: > On Wed, 2019-04-03 at 16:42 +0100, Daniel P. Berrangé wrote: > > docs: stop advertizing FTP or HTTP for downloads of libvirt > > We never advertised HTTP downloads, we only had an HTTPS URL > incorrectly labeled as "HTTP". So s/or HTTP // in the subject. The text later on says that it is available over HTTP, even if we typoed the link on this page. > > > On the modern internet it is not credible to continue to advertize > > software downloads over unencrypted connections. Even if users could > > theoretically use GPG to verify the signatures, not all our downloads > > and signed > > s/and/are/ > > Also, is that so? We should fix that. You mean fix that fact that not everything is signed ? > > @@ -27,8 +27,7 @@ > > <tr> > > <td>libvirt</td> > > <td> > > - <a href="ftp://libvirt.org/libvirt/">ftp</a> > > - <a href="https://libvirt.org/sources/">https</a> > > + <a href="https://libvirt.org/sources/">libvirt</a> > > That's... A whole lot of "libvirt"s in the page after the change. > > I don't have brilliant ideas on how to improve upon that, though. > Perhaps use "libvirt.org" instead of "libvirt"? Food for thought. I think it is ok - some of the other entries are "pypi" and "cpan". It is just a short nickname for the site hosting it. If people want the full URL they can see it in mouse-over. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :| -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list
On Thu, 2019-04-04 at 11:13 +0100, Daniel P. Berrangé wrote: > On Thu, Apr 04, 2019 at 10:51:22AM +0200, Andrea Bolognani wrote: > > On Wed, 2019-04-03 at 16:42 +0100, Daniel P. Berrangé wrote: > You mean fix that fact that not everything is signed ? Yes. Definitely for all releases going forward, if we're not doing so already; we might even consider signing old releases, since a signature made after the fact is still better than no signature at all IMHO. > > > - <a href="ftp://libvirt.org/libvirt/">ftp</a> > > > - <a href="https://libvirt.org/sources/">https</a> > > > + <a href="https://libvirt.org/sources/">libvirt</a> > > > > That's... A whole lot of "libvirt"s in the page after the change. > > > > I don't have brilliant ideas on how to improve upon that, though. > > Perhaps use "libvirt.org" instead of "libvirt"? Food for thought. > > I think it is ok - some of the other entries are "pypi" and "cpan". > It is just a short nickname for the site hosting it. If people want > the full URL they can see it in mouse-over. My issue is that while "github", "cpan" and friends are completely unambiguous in the context of the page, "libvirt" is far from it. But as I said I don't have a better solution to offer, so "libvirt" will have to do, at least for now :) -- Andrea Bolognani / Red Hat / Virtualization -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list
© 2016 - 2024 Red Hat, Inc.