[OE-core][PATCH] mirrors: switch Yocto Project mirrors to HTTPS

[OE-core][PATCH] mirrors: switch Yocto Project mirrors to HTTPS

[Viswanath Kraleti]

downloads.yoctoproject.org supports access over HTTPS, which provides
better security and reliability than HTTP.

Switch the default Yocto Project mirror URLs to use HTTPS instead of
HTTP to improve fetch reliability.

Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com>
---
 meta/classes-global/mirrors.bbclass | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/meta/classes-global/mirrors.bbclass b/meta/classes-global/mirrors.bbclass
index c8ceb9f5c4..c6092a6f41 100644
--- a/meta/classes-global/mirrors.bbclass
+++ b/meta/classes-global/mirrors.bbclass
@@ -29,13 +29,13 @@ ${SAVANNAH_NONGNU_MIRROR} http://download-mirror.savannah.nongnu.org/releases \
 ftp://sourceware.org/pub http://mirrors.edge.kernel.org/sourceware \
 ftp://sourceware.org/pub http://gd.tuwien.ac.at/gnu/sourceware \
 ftp://sourceware.org/pub http://ftp.gwdg.de/pub/linux/sources.redhat.com/sourceware \
-svn://.*/.*     http://downloads.yoctoproject.org/mirror/sources/ \
-git://.*/.*     http://downloads.yoctoproject.org/mirror/sources/ \
-gitsm://.*/.*   http://downloads.yoctoproject.org/mirror/sources/ \
-hg://.*/.*      http://downloads.yoctoproject.org/mirror/sources/ \
-https?://.*/.*  http://downloads.yoctoproject.org/mirror/sources/ \
-ftp://.*/.*     http://downloads.yoctoproject.org/mirror/sources/ \
-npm://.*/?.*    http://downloads.yoctoproject.org/mirror/sources/ \
+svn://.*/.*     https://downloads.yoctoproject.org/mirror/sources/ \
+git://.*/.*     https://downloads.yoctoproject.org/mirror/sources/ \
+gitsm://.*/.*   https://downloads.yoctoproject.org/mirror/sources/ \
+hg://.*/.*      https://downloads.yoctoproject.org/mirror/sources/ \
+https?://.*/.*  https://downloads.yoctoproject.org/mirror/sources/ \
+ftp://.*/.*     https://downloads.yoctoproject.org/mirror/sources/ \
+npm://.*/?.*    https://downloads.yoctoproject.org/mirror/sources/ \
 svn://.*/.*     http://sources.openembedded.org/ \
 git://.*/.*     http://sources.openembedded.org/ \
 gitsm://.*/.*   http://sources.openembedded.org/ \

Re: [OE-core][PATCH] mirrors: switch Yocto Project mirrors to HTTPS

[Antonin Godard]

On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via lists.openembedded.org wrote:
[...]
>  svn://.*/.*     http://sources.openembedded.org/ \
>  git://.*/.*     http://sources.openembedded.org/ \
>  gitsm://.*/.*   http://sources.openembedded.org/ \

On a related note, it seems that http://sources.openembedded.org/ is no longer
active. Could we remove it?

Antonin

Re: [OE-core][PATCH] mirrors: switch Yocto Project mirrors to HTTPS

[Jose Quaresma]

[-- Attachment #1: Type: text/plain, Size: 1221 bytes --]

Antonin Godard via lists.openembedded.org <antonin.godard=
bootlin.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s)
12:40):

> On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via
> lists.openembedded.org wrote:
> [...]
> >  svn://.*/.*     http://sources.openembedded.org/ \
> >  git://.*/.*     http://sources.openembedded.org/ \
> >  gitsm://.*/.*   http://sources.openembedded.org/ \
>
> On a related note, it seems that http://sources.openembedded.org/ is no
> longer
> active. Could we remove it?
>

I also noticed that when I tried it, but I was unsure if it was
intermittent or if it didn't even exist.
Add Michael in cc and perhaps he can confirm.

Jose


>
> Antonin
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#236007):
> https://lists.openembedded.org/g/openembedded-core/message/236007
> Mute This Topic: https://lists.openembedded.org/mt/119028000/5052612
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> quaresma.jose@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

-- 
Best regards,

José Quaresma

[-- Attachment #2: Type: text/html, Size: 2866 bytes --]

Re: [OE-core][PATCH] mirrors: switch Yocto Project mirrors to HTTPS

[Jose Quaresma]

[-- Attachment #1: Type: text/plain, Size: 1678 bytes --]

Jose Quaresma via lists.openembedded.org <quaresma.jose=
gmail.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 15:09):

>
>
> Antonin Godard via lists.openembedded.org <antonin.godard=
> bootlin.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s)
> 12:40):
>
>> On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via
>> lists.openembedded.org wrote:
>> [...]
>> >  svn://.*/.*     http://sources.openembedded.org/ \
>> >  git://.*/.*     http://sources.openembedded.org/ \
>> >  gitsm://.*/.*   http://sources.openembedded.org/ \
>>
>> On a related note, it seems that http://sources.openembedded.org/ is no
>> longer
>> active. Could we remove it?
>>
>
> I also noticed that when I tried it, but I was unsure if it was
> intermittent or if it didn't even exist.
> Add Michael in cc and perhaps he can confirm.
>

It's not intermittent, because the address still can't be resolved today.
I think it's safe to remove this addresses in a subsequent commit,
and if there are any complaints, we can revert the commit.

Jose


> Jose
>
>
>>
>> Antonin
>>
>>
>>
>>
>
> --
> Best regards,
>
> José Quaresma
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#236012):
> https://lists.openembedded.org/g/openembedded-core/message/236012
> Mute This Topic: https://lists.openembedded.org/mt/119028000/5052612
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> quaresma.jose@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

-- 
Best regards,

José Quaresma

[-- Attachment #2: Type: text/html, Size: 4103 bytes --]

Re: [OE-core][PATCH] mirrors: switch Yocto Project mirrors to HTTPS

[Richard Purdie]

On Tue, 2026-04-28 at 11:46 +0100, Jose Quaresma via lists.openembedded.org wrote:
> 
> 
> Jose Quaresma via lists.openembedded.org <quaresma.jose=gmail.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 15:09):
> > 
> > 
> > Antonin Godard via lists.openembedded.org <antonin.godard=bootlin.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 12:40):
> > > On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via lists.openembedded.org wrote:
> > > [...]
> > > >   svn://.*/.*     http://sources.openembedded.org/ \
> > > >   git://.*/.*     http://sources.openembedded.org/ \
> > > >   gitsm://.*/.*   http://sources.openembedded.org/ \
> > > 
> > > On a related note, it seems that http://sources.openembedded.org/ is no longer
> > > active. Could we remove it?
> > > 
> > 
> > 
> > I also noticed that when I tried it, but I was unsure if it was intermittent or if it didn't even exist.
> > Add Michael in cc and perhaps he can confirm.
> > 
> 
> 
> It's not intermittent, because the address still can't be resolved today.
> I think it's safe to remove this addresses in a subsequent commit,
> and if there are any complaints, we can revert the commit.

I know a bit of the history there and agree we should remove them.

Cheers,

Richard

Re: [OE-core][PATCH] mirrors: switch Yocto Project mirrors to HTTPS

[Richard Purdie]

On Mon, 2026-04-27 at 16:00 +0530, Viswanath Kraleti via lists.openembedded.org wrote:
> downloads.yoctoproject.org supports access over HTTPS, which provides
> better security and reliability than HTTP.
> 
> Switch the default Yocto Project mirror URLs to use HTTPS instead of
> HTTP to improve fetch reliability.
> 
> Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com>

I'm not going to fight against the current on this one but keep in mind
we checksum/verify anything we download, so http vs https doesn't
actually matter as much as people think here.

What we did used to care about more was the load on the server of https
vs http. I'm therefore not convinced about reliability or security.

Cheers,

Richard

Re: [OE-core][PATCH] mirrors: switch Yocto Project mirrors to HTTPS

[Viswanath Kraleti]

On Tue, Apr 28, 2026 at 4:53 PM Richard Purdie
<richard.purdie@linuxfoundation.org> wrote:
>
> On Tue, 2026-04-28 at 11:46 +0100, Jose Quaresma via lists.openembedded.org wrote:
> >
> >
> > Jose Quaresma via lists.openembedded.org <quaresma.jose=gmail.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 15:09):
> > >
> > >
> > > Antonin Godard via lists.openembedded.org <antonin.godard=bootlin.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 12:40):
> > > > On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via lists.openembedded.org wrote:
> > > > [...]
> > > > >   svn://.*/.*     http://sources.openembedded.org/ \
> > > > >   git://.*/.*     http://sources.openembedded.org/ \
> > > > >   gitsm://.*/.*   http://sources.openembedded.org/ \
> > > >
> > > > On a related note, it seems that http://sources.openembedded.org/ is no longer
> > > > active. Could we remove it?
> > > >
> > >
> > >
> > > I also noticed that when I tried it, but I was unsure if it was intermittent or if it didn't even exist.
> > > Add Michael in cc and perhaps he can confirm.
> > >
> >
> >
> > It's not intermittent, because the address still can't be resolved today.
> > I think it's safe to remove this addresses in a subsequent commit,
> > and if there are any complaints, we can revert the commit.
>
> I know a bit of the history there and agree we should remove them.
>

Thanks for the confirmation. I'll drop them.

> Cheers,
>
> Richard

Re: [OE-core][PATCH] mirrors: switch Yocto Project mirrors to HTTPS

[Antonin Godard]

On Tue Apr 28, 2026 at 2:01 PM CEST, Viswanath Kraleti wrote:
> On Tue, Apr 28, 2026 at 4:53 PM Richard Purdie
> <richard.purdie@linuxfoundation.org> wrote:
>>
>> On Tue, 2026-04-28 at 11:46 +0100, Jose Quaresma via lists.openembedded.org wrote:
>> >
>> >
>> > Jose Quaresma via lists.openembedded.org <quaresma.jose=gmail.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 15:09):
>> > >
>> > >
>> > > Antonin Godard via lists.openembedded.org <antonin.godard=bootlin.com@lists.openembedded.org> escreveu (segunda, 27/04/2026 à(s) 12:40):
>> > > > On Mon Apr 27, 2026 at 12:30 PM CEST, Viswanath Kraleti via lists.openembedded.org wrote:
>> > > > [...]
>> > > > >   svn://.*/.*     http://sources.openembedded.org/ \
>> > > > >   git://.*/.*     http://sources.openembedded.org/ \
>> > > > >   gitsm://.*/.*   http://sources.openembedded.org/ \
>> > > >
>> > > > On a related note, it seems that http://sources.openembedded.org/ is no longer
>> > > > active. Could we remove it?
>> > > >
>> > >
>> > >
>> > > I also noticed that when I tried it, but I was unsure if it was intermittent or if it didn't even exist.
>> > > Add Michael in cc and perhaps he can confirm.
>> > >
>> >
>> >
>> > It's not intermittent, because the address still can't be resolved today.
>> > I think it's safe to remove this addresses in a subsequent commit,
>> > and if there are any complaints, we can revert the commit.
>>
>> I know a bit of the history there and agree we should remove them.
>>
>
> Thanks for the confirmation. I'll drop them.

Sorry I forgot to cc you. I just sent a patch:
https://lore.kernel.org/r/20260428-remove-sources-openembedded-mirrors-v1-1-dbaea026dcdf@bootlin.com

Antonin

Re: [OE-core][PATCH] mirrors: switch Yocto Project mirrors to HTTPS

[Viswanath Kraleti]

On Tue, Apr 28, 2026 at 5:06 PM Richard Purdie
<richard.purdie@linuxfoundation.org> wrote:
>
> On Mon, 2026-04-27 at 16:00 +0530, Viswanath Kraleti via lists.openembedded.org wrote:
> > downloads.yoctoproject.org supports access over HTTPS, which provides
> > better security and reliability than HTTP.
> >
> > Switch the default Yocto Project mirror URLs to use HTTPS instead of
> > HTTP to improve fetch reliability.
> >
> > Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com>
>
> I'm not going to fight against the current on this one but keep in mind
> we checksum/verify anything we download, so http vs https doesn't
> actually matter as much as people think here.
>
> What we did used to care about more was the load on the server of https
> vs http. I'm therefore not convinced about reliability or security.
>

At least in my organization, accessing http servers from behind a
firewall is considered insecure and is subject to restrictions and
audits. I suspect many other workplaces follow similar practices.
Since the server already supports https, which is generally accepted,
switching to it seems like a better approach. Please let me know if
you think otherwise.

If needed, I can reword the commit message to clarify that this change
is primarily about aligning with best practices, rather than
introducing any reliability or security.

> Cheers,
>
> Richard
>
>
>
>
>