Downloads over HTTP?

[lol768]

Currently scala-lang.org links this URL:

http://downloads.lightbend.com/scala/2.12.1/scala-2.12.1.tgz

Said URL does not redirect to the HTTPS'd URL.

But, downloads.lightbend.com supports HTTPS. Why are the download links given using HTTP?

Related: #463

[jarrodu]

Good point.

grep -r 'downloads.lightbend.com' . | wc gives 336 results. Visual inspection shows that they are all http calls.

It would not be to hard to put together a PR for this.

[lol768]

It would not be to hard to put together a PR for this.

Agreed, see #628. I don't want to treat the symptom only though - where do these links come from? Are they generated automatically? Can I fix the source too?

[SethTisue]

where do these links come from? Are they generated automatically? Can I fix the source too?

they come from https://github.com/scala/make-release-notes; a PR on this in that repo would be very welcome

a PR addressing scala/make-release-notes#35 would also be very welcome; that would address the root cause of it not being obvious where the files come from

[ashawley]

Does this script need to be updated, too?

https://github.com/scala/scala-dist/blob/2.12.x/scripts/jobs/release/website/archives

It's not clear to me what it does, exactly, but it has a lightbend URL, as well.

[SethTisue]

Does this script need to be updated, too?

That would be nice. It's only using that URL to retrieve things, but it might as well use the more secure form.

As for the purpose of that section of the script, I don't recall having dealt with it before, but it takes the artifacts available at downloads.lightbend.com and also makes them available at http://www.scala-lang.org/files/archive/. (Digression: I'm not sure if that's just, like, a backup in case an asteroid hits Lightbend, or what? In the past, download pages like this one used the scala-lang URLs instead of the typesafe/lightbend URLs. Maybe lightbend.com has better connectivity or cheaper bandwidth or something.)

[SethTisue]

That would be nice.

Come to think of it, maybe it's more than nice, maybe it's really a good idea. Even if the scala-lang.org download URLs aren't usually used, this would still be a really bad place to fall prey to MITM and end up with compromised binaries on an official server.