gogol-admin-reports-0.2.0 data is incomplete about all-cabal-hashes HOT 10 CLOSED

Sure, no problem. The issue is:

• Hackage Security doesn't always generate JSON files: haskell/hackage-security#183
• The file you're looking for specifically broke the entire mirror process over the weekend: haskell-hvr/hackage-mirror-tool#2
• Because the connection to the Hackage server itself is insecure (HTTP), we cannot rely with downloads from it being untampered unless there is a Hackage Security signature
  • If you're wondering: Yes, https://hackage.haskell.org does work, but that's connecting to a CDN, which itself has an insecure connection to the Hackage server itself
  • The mirror tool we run connects directly to Hackage over its insecure connection
• Therefore, there's no way that we can reliably generate the .json files without risk of a MITM attack

In the past we generated the JSON files ourselves without relying on the upstream information, but that was before I was aware of the insecure connection between the CDN and Hackage. @lehins updated the mirroring tools recently to fix this.

I'm not getting traction upstream on this issue, so additional voices would be helpful. Filing against hackage-server probably makes sense.

from all-cabal-hashes.

from all-cabal-hashes.

I'm supposed to complain about a missing JSON file in all-cabal-hashes to the Hackage people? What good will that do?

from all-cabal-hashes.

from all-cabal-hashes.

I am sorry. I had not realized that you'd perceive my tone as offensive and I had no intention to come across that way. I apologize.

If you will, could you please explain to me why this is an upstream issue so that I can go ahead and try to get it fixed?

from all-cabal-hashes.

Because the connection to the Hackage server itself is insecure (HTTP), we cannot rely with downloads from it being untampered unless there is a Hackage Security signature

I checked our cdn settings, and in fact we do use a tls conduit between our cdn and the origin server. Image verifying settings below. It may be the case that we did not do so in the past but certainly we have had such a connection for quite some time.

from all-cabal-hashes.

My information was from September

haskell/hackage-server#540

from all-cabal-hashes.

Upstream ticket is haskell/hackage-server#488, which appears to be dead in the water since April 15th 2016. This is not very encouraging.

from all-cabal-hashes.

Don't despair. The renewed attention has revived interest in tackling it.

from all-cabal-hashes.

The problem has been fixed by upstream.

from all-cabal-hashes.