[jira] [Comment Edited] (CONNECTORS-1716) should not use http to download artifacts (need https)

2022-06-09 Thread PJ Fanning (Jira)


[ 
https://issues.apache.org/jira/browse/CONNECTORS-1716?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17552069#comment-17552069
 ] 

PJ Fanning edited comment on CONNECTORS-1716 at 6/9/22 9:19 AM:


[~kwri...@metacarta.com] https://github.com/apache/manifoldcf/pull/121

The reason not to use http in the build is that malicious actors could spoof 
the maven repo and you could end up building with a hacked version of the third 
party lib.


was (Author: pj.fanning):
[~kwri...@metacarta.com] https://github.com/apache/manifoldcf/pull/121

> should not use http to download artifacts (need https)
> --
>
> Key: CONNECTORS-1716
> URL: https://issues.apache.org/jira/browse/CONNECTORS-1716
> Project: ManifoldCF
>  Issue Type: Bug
>Reporter: PJ Fanning
>Assignee: Karl Wright
>Priority: Major
>
> build.xml has a number of insecure http URLs
> the nexus one is a special problem because the https equivalent has the wrong 
> SSL cert - see https://maven.nuxeo.com/



--
This message was sent by Atlassian Jira
(v8.20.7#820007)


[jira] [Comment Edited] (CONNECTORS-1716) should not use http to download artifacts (need https)

2022-06-09 Thread Karl Wright (Jira)


[ 
https://issues.apache.org/jira/browse/CONNECTORS-1716?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17552065#comment-17552065
 ] 

Karl Wright edited comment on CONNECTORS-1716 at 6/9/22 9:15 AM:
-

Please propose a patch.

I am not certain what downloads you are specifically talking about but this 
happens only during the build process, and may be for a testing artifact.  In 
some cases https is not used because it is not supported by the test component 
supplier, e.g. alfresco or mongodb.  If you can find a way around that, great, 
if not there is nothing we can do about it - e.g. the nuxeo case.  You should 
file a ticket with them.



was (Author: kwri...@metacarta.com):
Please propose a patch.

I am not certain what downloads you are specifically talking about but this 
happens only during the build process, and may be for a testing artifact.  In 
some cases https is not used because it is not supported by the test component 
supplier, e.g. alfresco or mongodb.  If you can find a way around that, great, 
if not there is nothing we can do about it.


> should not use http to download artifacts (need https)
> --
>
> Key: CONNECTORS-1716
> URL: https://issues.apache.org/jira/browse/CONNECTORS-1716
> Project: ManifoldCF
>  Issue Type: Bug
>Reporter: PJ Fanning
>Assignee: Karl Wright
>Priority: Major
>
> build.xml has a number of insecure http URLs
> the nexus one is a special problem because the https equivalent has the wrong 
> SSL cert - see https://maven.nuxeo.com/



--
This message was sent by Atlassian Jira
(v8.20.7#820007)