Re: [OE-core] [PATCH] global: convert all http to https

[Paul Barker <paul@pbarker.dev>]

[-- Attachment #1: Type: text/plain, Size: 1787 bytes --]

On Mon, 2026-01-19 at 13:29 +0100, Alexander Kanavin via
lists.openembedded.org wrote:
> I don't necessarily disagree with the conversion, but I would like
> proper verification of all links, and not not just 'some random
> validation'. You can extract all the new links from the patch and
> write a script that runs wget on them perhaps.
> 
> I also want to point out that there's no mechanism to enforce
> https-only layer metadata. New http links will creep in, there's no
> test to stop them.
> 
> Alex
> 
> On Fri, 16 Jan 2026 at 20:13, Andrew Geissler via
> lists.openembedded.org <geissonator=gmail.com@lists.openembedded.org>
> wrote:
> > 
> > Recently an internal lab network turned off all outgoing http access.
> > This means we are unable to build oe-core without manually setting up a
> > local cache or mirror. Given the security vulnerabilities around http and
> > that moving to https appears to have no impact on building, this commit
> > just moves everything over to https.
> > 
> > I wrote a python script and had it leave the following http links as-is:
> > - http://localhost, http://127.0.0.1
> > - http://example.com
> > - http://errors.yoctoproject.org
> > 
> > For testing I confirmed core-image-minimal still builds and did some
> > random validation of the links changed (but not every one of them).

Further to what Alex said: This patch needs splitting up to make it
reviewable. Perhaps one patch changing links in comments, one patch
changing links in HOMEPAGE/BUGTRACKER variables, and one patch changing
SRC_URI entries.

Links such as http://www.opensource.org/licenses/mit-license.php should
be replaced with a pointer to the LICENSE.MIT file at the root of the
repository.

Best regards,

-- 
Paul Barker


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]