google-chrome blocks downloads from get-o-o about get-o-o HOT 11 CLOSED

I added a note on this https://get.opensuse.org/tumbleweed/

from get-o-o.

Workaround: download image directly from e.g. http://download.opensuse.org/distribution/leap/15.3/

from get-o-o.

@hellcp could you please have a look at the issue? This seems like a priority because of the beta testing effort.

from get-o-o.

Originally reported by user using openSUSE :-) (but with Chrome downloaded directly from Google)

Another workaround is click on download button via right mouse click and select download. Then Chrome allows to download with warning, that it is dangerous.

from get-o-o.

The error from chromium:

Mixed Content: The site at 'https://get.opensuse.org/' was loaded over a secure connection, but the file at 'http://ftp.vectranet.pl/opensuse/distribution/leap/15.3/iso/openSUSE-Leap-15.3-NET-x86_64-Build91.1-Media.iso' was redirected through an insecure connection. This file should be served over HTTPS. This download has been blocked. See https://blog.chromium.org/2020/02/protecting-users-from-insecure.html for more details.

We may have to talk with mirrorbrain guys, because I can't really force https on the redirects down the line

from get-o-o.

For what it's worth, and I know it's not much, that would be very easy to fix with mirrormanager2, since you can actually request only getting https repos (using ?protocol=https in the url) with it...

from get-o-o.

https://progress.opensuse.org/issues/89578 for progress (haha) on the issue

The current decision seems to be to force get-o-o to redirect from https to http

from get-o-o.

hi just to add a little comment

if you click on https://download.opensuse.org/tumbleweed/iso/openSUSE-Tumbleweed-NET-x86_64-Current.iso by the donwload button nothing happen
if you right click on the button with save link as the redirect is resolved and point to : (in my case)
http://mirrors.gethosted.online/opensuse/tumbleweed/iso/openSUSE-Tumbleweed-NET-x86_64-Snapshot20210321-Media.iso
there the donwload is blocked with a security warning (you can enforce it and start the d/l)

now just replace http by https in the mirror url above and paste in the adress bar
bingo the download start immediately as expected.

tested also with this mirror with same results
http://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/iso/openSUSE-Tumbleweed-NET-x86_64-Snapshot20210321-Media.iso

clicking any mirror link in the mirror page https://download.opensuse.org/tumbleweed/iso/openSUSE-Tumbleweed-NET-x86_64-Snapshot20210321-Media.iso?mirrorlist
bring the security warning

tested on win 10 with google chrome 89.0.4389.90

from get-o-o.

nota

problem is not present on tumbleweed with chrome 90.0.4430.40 (beta)

from get-o-o.

So I noticed this issue has been around for over a month and will assume it will take time to make everything https.

I thought I would suggest adding some kind of instruction to new users as currently downloads fail silently and users will think the site is broken which would be a shame.

something like:
"to download files in chrome: right click and copy link address, paste in a new tab and hit enter"
in a big banner at the top.

from get-o-o.

This is fixed now

from get-o-o.