[#23435] - com_joomlaupdate - misleading information provided
- Closed
- 4 Mar 2019
- Medium
- Build: master
- # 23435
Steps to reproduce the issue
com_joomlaupdate shows "Update package URL" which is not used, instead an URL like this is being logged during
Joomla update:
Downloading update file from https://s3-us-west-2.amazonaws.com/joomla-official-downloads/joomladownloads/joomla3/Joomla_3.9.1-Stable-Update_Package.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIZ6S3Q3YQHG57ZRA%2F20190103%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20190103T114717Z&X-Amz-Expires=60&X-Amz-SignedHeaders=host&X-Amz-Signature=28121207467d3f6873907cafaed0c086d2d93cb38e41b7c8ebab35b4e39eb529
i do not think it is proper to mislead users with this information on joomla update site especially when amazon update URL does not work right now from Hetzner.de datacenter right now.
we suggest to use own domain names for such updates and own certicate chains which should be loaded during the joomla update so it does not rely on 3rd party interference (certificate chain or cloud being not available or US lines being not available from EU or Asia)
Expected result
- do not load US files from EU if not necessary
- do not use 3rd party certificate chains which you cannot control during the update
- use own domain names with DNSSEC for updates which you can globally adjust
Actual result
amazon's zip URL is not available from our server right now for unknown reason (certicate problem / IP rate limits / EU-US line not available / etc... )
System information (as much as possible)
hetzner data center + ubuntu 16.04 + php all versions (7.0 + 7.2 tested) + openssl 1.1 + ubuntu standard ca-certificate file
tested from joomla 3.9.0 while trying to update to 3.9.1 and also from joomla 3.9.1 trying to reinstall
file cannot be donwloaded and gives timeout
Additional comments
amazon's zip URL is not available from our server right now for unknown reason
if Hetzner.de datacenter has issues accessing publicly available resources on the internet, then that is not Joomla project's problem, that is Hetzner.de problem! Simple.
If they refuse to fix it, move to a web host that works.
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-03-04 12:25:42 |
| Closed_By | ⇒ | franz-wohlkoenig |
| Closed_Date | 2019-03-04 12:25:42 | ⇒ | 2019-03-04 12:25:43 |
| Closed_By | franz-wohlkoenig | ⇒ | joomla-cms-bot |
Set to "closed" on behalf of @franz-wohlkoenig by The JTracker Application at issues.joomla.org/joomla-cms/23435
closed as no Core-issue. This one can always be reopened.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/23435.
closed as no Core-issue. This one can always be reopened.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/23435.
The Downloads Portal uses Amazon services as its backend for delivering files, downloading a file directly from the site creates the same redirected request from
downloads.joomla.orgtos3-us-west-2.amazonaws.com(independently verifiable with your browser).If there is an issue with accessing the Amazon URL for whatever reason, the core update system has supported the notion of download mirrors for several releases now and will attempt to reach other locations, those URLs are publicly viewable via the update server's XML document at https://update.joomla.org/core/sts/extension_sts.xml (note GitHub too uses Amazon as a backend service provider, only the
update.joomla.orgentry is entirely resources on ajoomla.orgsubdomain).Unless someone wants to do yet another platform migration (which would be wholeheartedly against my recommendation), the Joomla project is not going to self host all of the packages and data for the sake of not using third party resources.