[#8186] - Switch update server to HTTPS
- Closed
- 27 Jan 2016
- Medium
- Build: master
- # 8186
Our update server now supports SSL connections. The CMS should be updated to query update.joomla.org via HTTPS.
| Labels |
Added:
?
|
||
| Milestone |
Added: |
||
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2015-10-29 11:14:45 |
| Closed_By | ⇒ | zero-24 |
| Milestone |
Removed: |
||
| Status | Closed | ⇒ | New |
| Closed_Date | 2015-10-29 11:14:44 | ⇒ | |
| Closed_By | zero-24 | ⇒ |
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2016-01-27 16:04:39 |
| Closed_By | ⇒ | mbabker |
Closing due to the commentary in the now closed pull request and the reluctance as a whole to enforce HTTPS connections on joomla.org properties.
I think we now have everything ready to use https as of 3.6
IMO one thing missing. the joomlacode.org language packs:
Example for pt-PT:
- URL 1 (https): https://update.joomla.org/language/translationlist_3.xml
- URL 2 (https): https://update.joomla.org/language/details3/pt-PT_details.xml
- URL 3 (http): http://joomlacode.org/gf/download/frsrelease/20263/163106/pt-PT_joomla_lang_full_3.5.1v1.zip
Also all language packs should use https in their manifest update server (not just en-GB) right?.
The project doesn't have a SSL certificate for joomlacode.org, opensourcematters.org, or the joom.la vanity URL.
yes, you already told me that i forgot.
but still
Also all language packs should use https in their manifest update server (not just en-GB) right?.
i also talked to jean marie about this.
In a perfect world yes they would specify HTTPS in their manifests. This also assumes they specify one (I don't know how they're structured so I don't know if they actually specify it or rely on the core's way of fetching the language packages to decide this).
joomlacode is dead soon. Me and Roland are getting together for 3 days at the end of June to finish the download site off i think (we organised it in Manchester)
In a perfect world yes
just a perfect world 
they would specify HTTPS in their manifests. This also assumes they specify one (I don't know how they're structured so I don't know if they actually specify it or rely on the core's way of fetching the language packages to decide this).
They all specify the same update server URL //update.joomla.org/language/translationlist_3.xml in their manifests, but pkg_en-GB specifies with HTTPS and all the others (currently) with HTTP.
Those are done by the translators. All we could do is to remind them to change it to https. But honestly, JC is dead as George mentioned and we're better off to just change it when the new server is alive 
Those are done by the translators. All we could do is to remind them to change it to https. But honestly, JC is dead as George mentioned and we're better off to just change it when the new server is alive
sure just alerting to that, in case you guys didn't notice that.
see: #8196