Uploaded image for project: 'Red Hat Developer Website'
  1. Red Hat Developer Website
  2. DEVELOPER-646

Official product downloads lack https URLs and checksums

This issue belongs to an archived project. You can view it, but you can't modify it. Learn more

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • None
    • None
    • None

    Description

      I noticed that on the new jboss.org site:

      http://www.jboss.org/products/

      People can now download our official product bits. The initial download URL, e.g.:

      http://www.jboss.org/download-manager/file/jboss-eap-6.2.0.GA-installer.jar

      Has a http URL. While you are eventually redirected to download the actual bits from access.cdn.redhat.com, it doesn't look good from a security perspective that the initial download link is not https. Could you please make all such download links use https?

      There are also no checksums provided to verify the product bits. Please show checksums for all downloads, similar to CSP, e.g.:

      https://access.redhat.com/jbossnetwork/restricted/softwareDetail.html?softwareId=26463&product=appplatform&version=6.2.0&downloadType=distributions

      Attachments

        Issue Links

          is blocked by

          Bug - A problem that impairs or prevents the functions of the product. CGW-530 Add REST API that allows the download manager to be the source of truth for all downloads

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Done

          Bug - A problem that impairs or prevents the functions of the product. CGW-692 Add REST API that exposes md5 and sha-256 file checksums, file size, file type, file name (human readable), any grouping needed and whether to display on www.jboss.org to the download Manager

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Done

          Activity

            People

              dcoughlin1 Daniel Coughlin (Inactive)
              dfj_jira David Jorm (Inactive)
              Archiver:
              rhn-support-ceverson Clark Everson

              Dates

                Created:
                Updated:
                Resolved:
                Archived:

                PagerDuty