All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Daniel P. Berrange" <berrange@redhat.com>
To: qemu-devel@nongnu.org
Cc: Peter Maydell <peter.maydell@linaro.org>,
	Paolo Bonzini <pbonzini@redhat.com>,
	"Daniel P. Berrange" <berrange@redhat.com>
Subject: [Qemu-devel] [PATCH web 0/2] Secure the download links and more
Date: Mon,  4 Sep 2017 15:26:06 +0100	[thread overview]
Message-ID: <20170904142608.4897-1-berrange@redhat.com> (raw)

Peter pointed out a bit of a crazy setup:

The front page link to the 2.10.0 tarball is

  http://download.qemu-project.org/qemu-2.10.0.tar.xz

which gets you a 301 redirect to

  http://download.qemu.org/qemu-2.10.0.tar.xz

which gets you a 301 redirect to

  https://download.qemu.org/qemu-2.10.0.tar.xz...

which gives the $BAD guys plenty chance to compromise your
download. Fix this to link to https:// sites exclusively
and use the preferred qemu.org domani too. All links are
fixed to use https, not merely download site links.

Daniel P. Berrange (2):
  Update all links to prefer qemu.org over qemu-project.org
  Use https links whereever possible

 .htaccess                                            |  6 +++---
 _download/source.html                                | 12 ++++++------
 _includes/footer.html                                | 18 +++++++++---------
 _includes/releases.html                              |  8 ++++----
 _posts/2017-02-04-the-new-qemu-website-is-up.md      | 10 +++++-----
 _posts/2017-03-19-qemu-in-the-blogs-february-2017.md |  4 ++--
 _posts/2017-08-10-deprecation.md                     |  2 +-
 contribute.md                                        |  8 ++++----
 contribute/report-a-bug.md                           |  6 +++---
 documentation.md                                     |  8 ++++----
 index.html                                           |  2 +-
 11 files changed, 42 insertions(+), 42 deletions(-)

-- 
2.13.5

             reply	other threads:[~2017-09-04 14:26 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-09-04 14:26 Daniel P. Berrange [this message]
2017-09-04 14:26 ` [Qemu-devel] [PATCH web 1/2] Update all links to prefer qemu.org over qemu-project.org Daniel P. Berrange
2017-09-04 14:26 ` [Qemu-devel] [PATCH web 2/2] Use https links whereever possible Daniel P. Berrange
2017-09-04 14:36 ` [Qemu-devel] [PATCH web 0/2] Secure the download links and more Eric Blake
2017-09-11 15:37 ` Paolo Bonzini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170904142608.4897-1-berrange@redhat.com \
    --to=berrange@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=peter.maydell@linaro.org \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.