Am 21.05.19 um 14:20 schrieb Mark Thomas: > On 21/05/2019 13:14, Coty Sutherland wrote: >> On Tue, May 21, 2019 at 8:10 AM Mark Thomas <ma...@apache.org >> <mailto:ma...@apache.org>> wrote: >> >> On 21/05/2019 13:08, Mark Thomas wrote: >> > On 21/05/2019 13:02, csuth...@apache.org >> <mailto:csuth...@apache.org> wrote: >> >> This is an automated email from the ASF dual-hosted git repository. >> >> >> >> csutherl pushed a commit to branch master >> >> in repository https://gitbox.apache.org/repos/asf/tomcat.git >> >> >> >> >> >> The following commit(s) were added to refs/heads/master by this push: >> >> new beb2dca Use https instead of http >> >> beb2dca is described below >> >> >> >> commit beb2dca83bb4084432fd3b44e06973730ad4dc7d >> >> Author: Coty Sutherland <csuth...@apache.org >> <mailto:csuth...@apache.org>> >> >> AuthorDate: Tue May 21 08:01:53 2019 -0400 >> >> >> >> Use https instead of http >> > >> > -1. Please revert this. It will break the build if a mirror is >> selected >> > that does not support http. It is also unnecessary. Any file >> downloaded >> >> s/does not support http/does not support https/ >> >> >> Ack. I checked the URL before pushing and noted that the mirrors I hit >> redirected to http, but I didn't happen to get one that didn't support >> it (and it didn't cross my mind). Reverted. > Thanks. > > Some of those links may be safe to switch to https but the mirror link > definitely isn't. > From memory there has already been at least one trawl though the Tomcat > repo changing everything to https that was safe to change. That was a > while ago. It may be time for another one. Anything that is changed > needs to be manually checked first to make sure that there is an https > equivalent.
The eclipse link seems to be safe to switch. My -- rather small -- experiments resulted in no redirects. All downloads were directly served. Felix > > Note that for the website, the recommendation is to use protocol > relative links so that users retain the choice of using http or https. > > Mark > >> >> >> >> Mark >> >> > over http is also checked against the known hash. >> > >> > Check the history of that file for more details. >> > >> > Mark >> > >> > >> > >> >> --- >> >> build.properties.default | 10 +++++----- >> >> build.xml | 2 +- >> >> 2 files changed, 6 insertions(+), 6 deletions(-) >> >> >> >> diff --git a/build.properties.default b/build.properties.default >> >> index 1bacc19..cc217b6 100644 >> >> --- a/build.properties.default >> >> +++ b/build.properties.default >> >> @@ -90,7 +90,7 @@ compile.debug=true >> >> # Do not pass -deprecation (-Xlint:deprecation) flag to javac >> >> compile.deprecation=false >> >> >> >> >> >> -base-apache.loc.1=http://www.apache.org/dyn/closer.lua?action=download&filename= >> >> >> >> +base-apache.loc.1=https://www.apache.org/dyn/closer.lua?action=download&filename= >> >> base-apache.loc.2=https://archive.apache.org/dist >> >> base-commons.loc.1=${base-apache.loc.1}/commons >> >> base-commons.loc.2=${base-apache.loc.2}/commons >> >> @@ -126,8 +126,8 @@ >> >> wsdl4j-lib.loc=${base-maven.loc}/wsdl4j/wsdl4j/${wsdl4j-lib.version}/wsdl4j-${ws >> >> # See https://wiki.apache.org/tomcat/JDTCoreBatchCompiler before >> updating >> >> # >> >> # Checksum is from "SHA512 Checksums for 4.10" link at >> >> -# >> http://download.eclipse.org/eclipse/downloads/drops4/R-4.10-201812060815/ >> >> -# >> >> http://download.eclipse.org/eclipse/downloads/drops4/R-4.10-201812060815/checksum/eclipse-4.10-SUMSSHA512 >> >> +# >> >> https://download.eclipse.org/eclipse/downloads/drops4/R-4.10-201812060815/ >> >> +# >> >> https://download.eclipse.org/eclipse/downloads/drops4/R-4.10-201812060815/checksum/eclipse-4.10-SUMSSHA512 >> >> # >> >> jdt.version=4.10 >> >> jdt.release=R-4.10-201812060815 >> >> @@ -137,8 +137,8 @@ >> >> jdt.checksum.value=6528d1933d752f909e61456f1a3cbb3ae3999d263701a459e6f4fc33f97f7 >> >> jdt.home=${base.path}/ecj-${jdt.version} >> >> jdt.jar=${jdt.home}/ecj-${jdt.version}.jar >> >> # The download will be moved to the archive area eventually. We >> are taking care of that in advance. >> >> >> >> -jdt.loc.1=http://archive.eclipse.org/eclipse/downloads/drops4/${jdt.release}/ecj-${jdt.version}.jar >> >> <http://archive.eclipse.org/eclipse/downloads/drops4/$%7Bjdt.release%7D/ecj-$%7Bjdt.version%7D.jar> >> >> >> >> -jdt.loc.2=http://download.eclipse.org/eclipse/downloads/drops4/${jdt.release}/ecj-${jdt.version}.jar >> >> <http://download.eclipse.org/eclipse/downloads/drops4/$%7Bjdt.release%7D/ecj-$%7Bjdt.version%7D.jar> >> >> >> >> +jdt.loc.1=https://archive.eclipse.org/eclipse/downloads/drops4/${jdt.release}/ecj-${jdt.version}.jar >> >> <https://archive.eclipse.org/eclipse/downloads/drops4/$%7Bjdt.release%7D/ecj-$%7Bjdt.version%7D.jar> >> >> >> >> +jdt.loc.2=https://download.eclipse.org/eclipse/downloads/drops4/${jdt.release}/ecj-${jdt.version}.jar >> >> <https://download.eclipse.org/eclipse/downloads/drops4/$%7Bjdt.release%7D/ecj-$%7Bjdt.version%7D.jar> >> >> >> >> # ----- Tomcat native library ----- >> >> tomcat-native.version=1.2.21 >> >> diff --git a/build.xml b/build.xml >> >> index 6e91e91..4d76077 100644 >> >> --- a/build.xml >> >> +++ b/build.xml >> >> @@ -1971,7 +1971,7 @@ Apache Tomcat ${version} native binaries >> for Win64 AMD64/EMT64 platform. >> >> <link href="../jspapi"/> >> >> <link href="../elapi"/> >> >> <link href="../websocketapi"/> >> >> - <link href="http://docs.oracle.com/javase/8/docs/api/"/> >> >> + <link href="https://docs.oracle.com/javase/8/docs/api/"/> >> >> <link >> >> href="https://commons.apache.org/proper/commons-io/javadocs/api-release/"/> >> >> <link href="https://javaee.github.io/javaee-spec/javadocs/"/> >> >> <packageset dir="${tomcat.dist}/src/java/"> >> >> >> >> >> >> --------------------------------------------------------------------- >> >> To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org >> <mailto:dev-unsubscr...@tomcat.apache.org> >> >> For additional commands, e-mail: dev-h...@tomcat.apache.org >> <mailto:dev-h...@tomcat.apache.org> >> >> >> > >> > >> > --------------------------------------------------------------------- >> > To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org >> <mailto:dev-unsubscr...@tomcat.apache.org> >> > For additional commands, e-mail: dev-h...@tomcat.apache.org >> <mailto:dev-h...@tomcat.apache.org> >> > >> >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org >> <mailto:dev-unsubscr...@tomcat.apache.org> >> For additional commands, e-mail: dev-h...@tomcat.apache.org >> <mailto:dev-h...@tomcat.apache.org> >> > > --------------------------------------------------------------------- > To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org > For additional commands, e-mail: dev-h...@tomcat.apache.org > --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
