User Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Build ID: 20151027170520 Steps to reproduce: 1. Go to https://www.mozilla.org/en-US/thunderbird/all/ 2. Click English (US) download link for Thunderbird for Linux 64 bit, which points to https://download.mozilla.org/?product=thunderbird-38.4.0&os=linux64&lang=en-US 3. Actual download proceeded from via unprotected http URL instead of encrypted https: http://download.cdn.mozilla.net/pub/thunderbird/releases/38.4.0/linux-x86_64/en-US/thunderbird-38.4.0.tar.bz2 Actual results: Thunderbird had been downloaded, but it cannot be trusted because of possible modifications during download Expected results: The link https://download.mozilla.org/?product=thunderbird-38.4.0&os=linux64&lang=en-US and all other links on thunderbird download page should redirect to https:// urls
Component: Thunderbird → Bouncer
Product: www.mozilla.org → Webtools
Version: Production → Trunk
I believe these redirect are not handled by www.mozilla.org, so moving to the Bouncer component.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Summary: thunderbird https → thunderbird download https changes to http
Component: Bouncer → Operations: Product Delivery
Product: Webtools → Cloud Services
QA Contact: oremj
See Also: → bug 1257214
Version: Trunk → unspecified
Looks like we need the -SSL suffix like Firefox to download the files via HTTPS: https://download.mozilla.org/?product=thunderbird-38.4.0-SSL&os=linux64&lang=en-US I don't know why HTTPS is not used by default though.
Let's get this fixed on www.mozilla.org side by simply adding 4 characters until the -SSL suffix will no longer be required.
Assignee: nobody → kohei.yoshino
Status: NEW → ASSIGNED
Component: Operations: Product Delivery → Thunderbird
Product: Cloud Services → www.mozilla.org
QA Contact: oremj
Version: unspecified → Production
Commits pushed to master at https://github.com/mozilla/bedrock https://github.com/mozilla/bedrock/commit/eee1f738b491cfe27b424e66f10a01be59806fc6 Fix Bug 1228502 - thunderbird download https changes to http https://github.com/mozilla/bedrock/commit/b199a9a9cee4ebcb4d7d0f457c7330a55c25721e Merge pull request #4001 from kyoshino/bug-1228502-thunderbird-ssl Fix Bug 1228502 - thunderbird download https changes to http
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.