979136 - Tarako tree is checked out over clear text channel

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: General, defect)

Description

[Hubert Figuiere [:hub]]

While https is no silver bullet, checking out the source code over plain text http is probably even worse.

Here are the relevant parts of the manifest:

  <remote name="aosp" fetch="http://sprdsource.spreadtrum.com:8085/b2g/android" />
  <remote name="sprd-b2g" fetch="http://sprdsource.spreadtrum.com:8085/b2g" />
  <remote name="sprd-aosp" fetch="http://sprdsource.spreadtrum.com:8085/b2g/android" />

Comment 1

[Hubert Figuiere [:hub]]

The repository mentioned at https://bugzilla.mozilla.org/show_bug.cgi?id=956631

Comment 2

[James Zhang (Spreadtrum)]

(In reply to Hubert Figuiere [:hub] from comment #0)
> While https is no silver bullet, checking out the source code over plain
> text http is probably even worse.
> 
> Here are the relevant parts of the manifest:
> 
>   <remote name="aosp"
> fetch="http://sprdsource.spreadtrum.com:8085/b2g/android" />
>   <remote name="sprd-b2g" fetch="http://sprdsource.spreadtrum.com:8085/b2g"
> />
>   <remote name="sprd-aosp"
> fetch="http://sprdsource.spreadtrum.com:8085/b2g/android" />

Do you want to change http to git? We can support git.

Comment 3

[Hubert Figuiere [:hub]]

git isn't secure either.

And now that I look at it we checkout other stuff over git protocol. Its only advantage is that it is faster.
Will file a bug for that.

Comment 4

[BMO Automation]

Firefox OS is not being worked on