On 15/07/2019 10.49, Christoph wrote:> Tomas Krizek: Interesting point. However, I investigated a little further and I'm afraid we're not able to switch to https, since we can't guarantee users won't run into other issues. download.opensuse.org is just a CDN, and the mirrors you can get redirected to may not support https, which would result in errors such as [open-build-service#7830] With OBS, there's an even bigger issue that actualy motivated us to create the knot-resolver-release package - it's even the signing keys, that they deliver through http! [open-build-service#449] However, this was mainly an issue for RPM-based distros, where the [repofile] had a signing key served over http, due to the same issue as above. With the knot-resolver-release package, we can at least deliver the singing keys securely, when you install that package over https from secure.nic.cz [open-build-service#7830] - https://github.com/openSUSE/open-build-service/issues/7830 [open-build-service#449] - https://github.com/openSUSE/open-build-service/issues/449 [repofile] - https://download.opensuse.org/repositories/home:/CZ-NIC:/knot-resolver-late… -- Tomas Krizek PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869