On Tue, 2020-09-15 at 09:57 -0700, Kevin Fenzi wrote:
On Tue, Sep 15, 2020 at 04:05:09PM +0200, Kamil Paral wrote:
I'd like to clarify some of our criteria which only refer to HTTP and don't mention HTTPS. In particular:
"When using a release-blocking dedicated installer image, the installer must be able to use either HTTP or FTP repositories (or both) as package sources. Release-blocking network install images must default to a valid publicly-accessible package source." https://fedoraproject.org/wiki/Basic_Release_Criteria#Remote_package_sources
"The installer must be able to download and use an installer update image from an HTTP server." https://fedoraproject.org/wiki/Basic_Release_Criteria#Update_image
"When using the dedicated installer images, the installer must be able to use HTTP, FTP and NFS repositories as package sources." https://fedoraproject.org/wiki/Fedora_33_Beta_Release_Criteria#Remote_packag...
I propose to change "HTTP" to "HTTP(S)" in all these cases (including footnotes, where applicable).
So, from an infrastructure perspective... we do have http mirrors still. If you are using a metalink there's not any security problem using http, although there is a privacy one (anyone sniffing the traffic can see what you are downloading).
We no longer have/support ftp mirrors in mirrormanager, we dropped them a while back.
I don't know if this case uses a metalink? Does it?
If we want to keep supporting FTP, we may have to test it locally as mirrormanager doesn't support it anymore.
The criterion as written refers to "repositories", which really is talking about direct repo URLs, not mirrorlists *or* metalinks.
openQA tests direct HTTPS repository, direct NFS repository, and HTTPS mirrorlist; it doesn't test metalink (which is why it didn't catch the bug Kamil filed), IIRC because metalink can be flaky if it gets the repo data from a slow server or something. It doesn't test FTP either.
I think we could possibly do any or all of the following:
1) As Kamil proposes, change HTTP to HTTP(S) 2) Drop FTP (I don't think we really need to support it any more) 3) Specifically cover metalink and mirrorlist sources