Mailing-List: contact docs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: docs@httpd.apache.org
Subject: Re: [Bug 55808] File integrity verification using MD5 and SHA1
To: docs@httpd.apache.org
References: <bug-55808-56585@https.bz.apache.org/bugzilla/>
 <bug-55808-56585-wzfMd0JVSx@https.bz.apache.org/bugzilla/>
 <5696D835.5050904@blenning.no>
 <CAKQ1sVMU=o24Rrw5zF2oLozgyqMFn5DZKAJbJVOLot+4nX4iBA@mail.gmail.com>
From: Tom Fredrik Blenning Klaussen <bfg@blenning.no>
Message-ID: <569EC2DD.5080307@blenning.no>
Date: Wed, 20 Jan 2016 00:12:29 +0100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0)
 Gecko/20100101 Thunderbird/38.5.1
MIME-Version: 1.0
In-Reply-To: 
 <CAKQ1sVMU=o24Rrw5zF2oLozgyqMFn5DZKAJbJVOLot+4nX4iBA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


On 14/01/16 00:50, Yann Ylavic wrote:
> On Thu, Jan 14, 2016 at 12:05 AM, Tom Fredrik Blenning Klaussen 
> <bfg@blenning.no> wrote:
>> 
>> 
>> On 13/01/16 23:56, bugzilla@apache.org wrote:
>>>> 
>>>> It just so happens that the https addresses do not have a
>>>> valid security certificate which is a second bug.
>>> 
>>> Could you elaborate? No alert when I access 
>>> https://www.apache.org/dist/httpd/httpd-2.4.18.tar.bz2.sha1
>>> from here.
>> 
>> So I start out at https://httpd.apache.org/download.cgi
>> 
>> The two relevant links from this page are: 
>> http://www.eu.apache.org/dist//httpd/httpd-2.4.18.tar.bz2 
>> http://www.apache.org/dist/httpd/httpd-2.4.18.tar.bz2.sha1
>> 
>> Obviously both are http addresses, so that's the first error
>> when linked from https.
> 
> My firefox does not warn in this case (this is a different domain)
> but nevermind. Wherever the tarball comes from, it has to be
> checked against the digests from https://httpd.apache.org/dist/ for
> any trust to be possible (this is less/not a requirement for PGP
> though, the trust is more on the signer). Even if you change the
> mirror on the /dowwload.cgi page, the links to the digests remain
> the same.
> 
>> 
>> Replacing http with https for both links works, but for the
>> former: 
>> https://www.eu.apache.org/dist//httpd/httpd-2.4.18.tar.bz2
>> 
>> there is a certificate error. Firefox: (Error code: 
>> ssl_error_bad_cert_domain)
> 
> That could be addressed by the infra team, but I guess it does not 
> matter too much, it's a backup host (note that the certificate is
> the same as for httpd.apache.org, i.e. *.apache.org).

Did you file any bug about this?
How do I address the infra team?

---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org