thunderbird download https changes to http

RESOLVED FIXED

Status

RESOLVED FIXED
3 years ago
2 months ago

People

(Reporter: egor.duda, Assigned: kohei)

Tracking

Production

Details

(URL)

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
User Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:38.0) Gecko/20100101 Firefox/38.0
Build ID: 20151027170520

Steps to reproduce:

1. Go to https://www.mozilla.org/en-US/thunderbird/all/

2. Click English (US) download link for Thunderbird for Linux 64 bit, which points to https://download.mozilla.org/?product=thunderbird-38.4.0&os=linux64&lang=en-US

3. Actual download proceeded from via unprotected http URL instead of encrypted https: http://download.cdn.mozilla.net/pub/thunderbird/releases/38.4.0/linux-x86_64/en-US/thunderbird-38.4.0.tar.bz2






Actual results:

Thunderbird had been downloaded, but it cannot be trusted because of possible modifications during download


Expected results:

The link https://download.mozilla.org/?product=thunderbird-38.4.0&os=linux64&lang=en-US and all other links on thunderbird download page should redirect to https:// urls

Updated

3 years ago
Component: Thunderbird → Bouncer
Product: www.mozilla.org → Webtools
Version: Production → Trunk
I believe these redirect are not handled by www.mozilla.org, so moving to the Bouncer component.

Updated

3 years ago
Status: UNCONFIRMED → NEW
Ever confirmed: true
Summary: thunderbird https → thunderbird download https changes to http
(Assignee)

Updated

2 years ago
Component: Bouncer → Operations: Product Delivery
Product: Webtools → Cloud Services
QA Contact: oremj
See Also: → bug 1257214
Version: Trunk → unspecified
(Assignee)

Comment 2

2 years ago
Looks like we need the -SSL suffix like Firefox to download the files via HTTPS:
https://download.mozilla.org/?product=thunderbird-38.4.0-SSL&os=linux64&lang=en-US

I don't know why HTTPS is not used by default though.
(Assignee)

Comment 3

2 years ago
Let's get this fixed on www.mozilla.org side by simply adding 4 characters until the -SSL suffix will no longer be required.
Assignee: nobody → kohei.yoshino
Status: NEW → ASSIGNED
Component: Operations: Product Delivery → Thunderbird
Product: Cloud Services → www.mozilla.org
QA Contact: oremj
Version: unspecified → Production
(Assignee)

Comment 4

2 years ago
Created attachment 8733332 [details] [review]
pull request

Comment 5

2 years ago
Commits pushed to master at https://github.com/mozilla/bedrock

https://github.com/mozilla/bedrock/commit/eee1f738b491cfe27b424e66f10a01be59806fc6
Fix Bug 1228502 - thunderbird download https changes to http

https://github.com/mozilla/bedrock/commit/b199a9a9cee4ebcb4d7d0f457c7330a55c25721e
Merge pull request #4001 from kyoshino/bug-1228502-thunderbird-ssl

Fix Bug 1228502 - thunderbird download https changes to http

Updated

2 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → FIXED

Updated

2 years ago
See Also: → bug 1258123

Updated

2 months ago
Product: www.mozilla.org → www.mozilla.org Graveyard
You need to log in before you can comment on or make changes to this bug.