uvt-simplestreams downloads via https, breaking caching
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
uvtool |
Fix Committed
|
Medium
|
Unassigned |
Bug Description
The default (in uvtool/
sync_
default='https:/
This means that caching and proxying of images is not available.
Whilst this may be fine for those people who happen to have fibre or another fast connection to ubuntu.com, for people who are trying to develop or test things, having to repeatedly download 300+mb files is a massive issue.
Serving the files over https is counter intuitive, as well, as everything is already GPG signed. Normally, belt and suspenders security isn't an issue, but this is a significant issue, and doesn't offer any advantages over serving the files over http.
Changed in uvtool: | |
status: | Triaged → Fix Committed |
Thank you for reporting this bug.
It does leak what you're downloading though (which exact images, as opposed to just images). I'm not opposed to changing the default to http (as you say, downloads are verified with gpg), but I think that we need to be very cautious about making this change.