[libvirt] [PATCH] docs: stop advertizing FTP or HTTP for downloads of libvirt
On the modern internet it is not credible to continue to advertize software downloads over unencrypted connections. Even if users could theoretically use GPG to verify the signatures, not all our downloads and signed and few people know how to correctly verify signatures. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> --- docs/downloads.html.in | 61 ++++++++++++++---------------------------- 1 file changed, 20 insertions(+), 41 deletions(-) diff --git a/docs/downloads.html.in b/docs/downloads.html.in index 657cd6a6f8..0722469eb9 100644 --- a/docs/downloads.html.in +++ b/docs/downloads.html.in @@ -27,8 +27,7 @@ <tr> <td>libvirt</td> <td> - <a href="ftp://libvirt.org/libvirt/">ftp</a> - <a href="https://libvirt.org/sources/">https</a> + <a href="https://libvirt.org/sources/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt.git;a=summary">libvirt</a> @@ -48,8 +47,7 @@ <tr> <td>C#</td> <td> - <a href="ftp://libvirt.org/libvirt/csharp/">ftp</a> - <a href="https://libvirt.org/sources/csharp/">https</a> + <a href="https://libvirt.org/sources/csharp/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-csharp.git;a=summary">libvirt</a> @@ -63,8 +61,7 @@ <tr> <td>Go</td> <td> - <a href="ftp://libvirt.org/libvirt/go/">ftp</a> - <a href="https://libvirt.org/sources/go/">https</a> + <a href="https://libvirt.org/sources/go/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-go.git;a=summary">libvirt</a> @@ -80,8 +77,7 @@ <tr> <td>Java</td> <td> - <a href="ftp://libvirt.org/libvirt/java/">ftp</a> - <a href="https://libvirt.org/sources/java/">https</a> + <a href="https://libvirt.org/sources/java/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-java.git;a=summary">libvirt</a> @@ -95,8 +91,7 @@ <tr> <td>OCaml</td> <td> - <a href="ftp://libvirt.org/libvirt/ocaml/">ftp</a> - <a href="https://libvirt.org/sources/ocaml/">https</a> + <a href="https://libvirt.org/sources/ocaml/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-ocaml.git;a=summary">libvirt</a> @@ -127,8 +122,7 @@ <tr> <td>PHP</td> <td> - <a href="ftp://libvirt.org/libvirt/php/">ftp</a> - <a href="https://libvirt.org/sources/php/">https</a> + <a href="https://libvirt.org/sources/php/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-php.git;a=summary">libvirt</a> @@ -142,8 +136,7 @@ <tr> <td>Python</td> <td> - <a href="ftp://libvirt.org/libvirt/python/">ftp</a> - <a href="https://libvirt.org/sources/python/">https</a> + <a href="https://libvirt.org/sources/python/">libvirt</a> <a href="https://pypi.python.org/pypi/libvirt-python">pypi</a> </td> <td> @@ -158,8 +151,7 @@ <tr> <td>Ruby</td> <td> - <a href="ftp://libvirt.org/libvirt/ruby/">ftp</a> - <a href="https://libvirt.org/sources/ruby/">https</a> + <a href="https://libvirt.org/sources/ruby/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=ruby-libvirt.git;a=summary">libvirt</a> @@ -173,8 +165,7 @@ <tr> <td>Rust</td> <td> - <a href="ftp://libvirt.org/libvirt/rust/">ftp</a> - <a href="https://libvirt.org/sources/rust/">https</a> + <a href="https://libvirt.org/sources/rust/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-rust.git;a=summary">libvirt</a> @@ -191,8 +182,7 @@ <tr> <td>GLib / GConfig / GObject</td> <td> - <a href="ftp://libvirt.org/libvirt/glib/">ftp</a> - <a href="https://libvirt.org/sources/glib/">https</a> + <a href="https://libvirt.org/sources/glib/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-glib.git;a=summary">libvirt</a> @@ -206,8 +196,7 @@ <tr> <td>Go XML</td> <td> - <a href="ftp://libvirt.org/libvirt/go/">ftp</a> - <a href="https://libvirt.org/sources/go/">https</a> + <a href="https://libvirt.org/sources/go/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-go-xml.git;a=summary">libvirt</a> @@ -223,8 +212,7 @@ <tr> <td>D-Bus</td> <td> - <a href="ftp://libvirt.org/libvirt/dbus/">ftp</a> - <a href="https://libvirt.org/sources/dbus/">https</a> + <a href="https://libvirt.org/sources/dbus/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-dbus.git;a=summary">libvirt</a> @@ -238,8 +226,7 @@ <tr> <td>Console Proxy</td> <td> - <a href="ftp://libvirt.org/libvirt/consoleproxy/">ftp</a> - <a href="https://libvirt.org/sources/consoleproxy/">https</a> + <a href="https://libvirt.org/sources/consoleproxy/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-console-proxy.git;a=summary">libvirt</a> @@ -253,8 +240,7 @@ <tr> <td>CIM provider</td> <td> - <a href="ftp://libvirt.org/libvirt/CIM/">ftp</a> - <a href="https://libvirt.org/sources/CIM/">https</a> + <a href="https://libvirt.org/sources/CIM/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-cim.git;a=summary">libvirt</a> @@ -268,8 +254,7 @@ <tr> <td>CIM utils</td> <td> - <a href="ftp://libvirt.org/libvirt/CIM/">ftp</a> - <a href="https://libvirt.org/sources/CIM/">https</a> + <a href="https://libvirt.org/sources/CIM/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libcmpiutil.git;a=summary">libvirt</a> @@ -283,8 +268,7 @@ <tr> <td>SNMP</td> <td> - <a href="ftp://libvirt.org/libvirt/snmp/">ftp</a> - <a href="https://libvirt.org/sources/snmp/">https</a> + <a href="https://libvirt.org/sources/snmp/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-snmp.git;a=summary">libvirt</a> @@ -298,8 +282,7 @@ <tr> <td>Application Sandbox</td> <td> - <a href="ftp://libvirt.org/libvirt/sandbox/">ftp</a> - <a href="https://libvirt.org/sources/sandbox/">https</a> + <a href="https://libvirt.org/sources/sandbox/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-sandbox.git;a=summary">libvirt</a> @@ -316,8 +299,7 @@ <tr> <td>TCK</td> <td> - <a href="ftp://libvirt.org/libvirt/tck/">ftp</a> - <a href="https://libvirt.org/sources/tck/">https</a> + <a href="https://libvirt.org/sources/tck/">libvirt</a> </td> <td> <a href="https://libvirt.org/git/?p=libvirt-tck.git;a=summary">libvirt</a> @@ -422,14 +404,11 @@ <p> Most modules have releases made available for download on the project - site, via FTP, HTTP or HTTPS. Some modules are instead made available - at alternative locations, for example, the Perl binding is made - available only on CPAN. + site via HTTPS. Some modules are instead made available at alternative + locations, for example, the Perl binding is made available only on CPAN. </p> <ul> - <li><a href="ftp://libvirt.org/libvirt/">libvirt.org FTP server</a></li> - <li><a href="https://libvirt.org/sources/">libvirt.org HTTP server</a></li> <li><a href="https://libvirt.org/sources/">libvirt.org HTTPS server</a></li> </ul> -- 2.20.1
On Wed, 2019-04-03 at 16:42 +0100, Daniel P. Berrangé wrote:
docs: stop advertizing FTP or HTTP for downloads of libvirt
We never advertised HTTP downloads, we only had an HTTPS URL incorrectly labeled as "HTTP". So s/or HTTP // in the subject.
On the modern internet it is not credible to continue to advertize software downloads over unencrypted connections. Even if users could theoretically use GPG to verify the signatures, not all our downloads and signed
s/and/are/ Also, is that so? We should fix that. [...]
@@ -27,8 +27,7 @@ <tr> <td>libvirt</td> <td> - <a href="ftp://libvirt.org/libvirt/">ftp</a> - <a href="https://libvirt.org/sources/">https</a> + <a href="https://libvirt.org/sources/">libvirt</a>
That's... A whole lot of "libvirt"s in the page after the change. I don't have brilliant ideas on how to improve upon that, though. Perhaps use "libvirt.org" instead of "libvirt"? Food for thought. For the time being, with the commit message fixed Reviewed-by: Andrea Bolognani <abologna@redhat.com> -- Andrea Bolognani / Red Hat / Virtualization
On Thu, Apr 04, 2019 at 10:51:22AM +0200, Andrea Bolognani wrote:
On Wed, 2019-04-03 at 16:42 +0100, Daniel P. Berrangé wrote:
docs: stop advertizing FTP or HTTP for downloads of libvirt
We never advertised HTTP downloads, we only had an HTTPS URL incorrectly labeled as "HTTP". So s/or HTTP // in the subject.
The text later on says that it is available over HTTP, even if we typoed the link on this page.
On the modern internet it is not credible to continue to advertize software downloads over unencrypted connections. Even if users could theoretically use GPG to verify the signatures, not all our downloads and signed
s/and/are/
Also, is that so? We should fix that.
You mean fix that fact that not everything is signed ?
@@ -27,8 +27,7 @@ <tr> <td>libvirt</td> <td> - <a href="ftp://libvirt.org/libvirt/">ftp</a> - <a href="https://libvirt.org/sources/">https</a> + <a href="https://libvirt.org/sources/">libvirt</a>
That's... A whole lot of "libvirt"s in the page after the change.
I don't have brilliant ideas on how to improve upon that, though. Perhaps use "libvirt.org" instead of "libvirt"? Food for thought.
I think it is ok - some of the other entries are "pypi" and "cpan". It is just a short nickname for the site hosting it. If people want the full URL they can see it in mouse-over. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
On Thu, 2019-04-04 at 11:13 +0100, Daniel P. Berrangé wrote:
On Thu, Apr 04, 2019 at 10:51:22AM +0200, Andrea Bolognani wrote:
On Wed, 2019-04-03 at 16:42 +0100, Daniel P. Berrangé wrote: You mean fix that fact that not everything is signed ?
Yes. Definitely for all releases going forward, if we're not doing so already; we might even consider signing old releases, since a signature made after the fact is still better than no signature at all IMHO.
- <a href="ftp://libvirt.org/libvirt/">ftp</a> - <a href="https://libvirt.org/sources/">https</a> + <a href="https://libvirt.org/sources/">libvirt</a>
That's... A whole lot of "libvirt"s in the page after the change.
I don't have brilliant ideas on how to improve upon that, though. Perhaps use "libvirt.org" instead of "libvirt"? Food for thought.
I think it is ok - some of the other entries are "pypi" and "cpan". It is just a short nickname for the site hosting it. If people want the full URL they can see it in mouse-over.
My issue is that while "github", "cpan" and friends are completely unambiguous in the context of the page, "libvirt" is far from it. But as I said I don't have a better solution to offer, so "libvirt" will have to do, at least for now :) -- Andrea Bolognani / Red Hat / Virtualization
participants (2)
-
Andrea Bolognani -
Daniel P. Berrangé