Launchpad itself

Support listing HTTPS archive mirrors

Bug #1255120 reported by Bryan Quigley
62
This bug affects 11 people
Affects Status Importance Assigned to Milestone
Launchpad itself
Fix Released
Low
Thiago F. Pappacena

Bug Description

Currently we support listing mirrors for http ftp and rsync [1]. We should support mirrors that want to be listed as supporting https as well.

There are a couple of other issues blocking this, currently we have only one mirror that works via HTTPS. (Some others like "https://mirrors.nl.eu.kernel.org/" don't work because *.kernel.org cert doesn't apply to it that domain)

[1] https://launchpad.net/ubuntu/+archivemirrors

Tags: mirror

Related branches

lp://staging/~abrody/launchpad/https-mirror-dbchange
Colin Watson (community): Approve
Diff: 19 lines (+15/-0)
1 file modified
database/schema/patch-2209-99-0.sql (+15/-0)
Colin Watson (community): Needs Resubmitting
Diff: 19 lines (+15/-0)
1 file modified
database/schema/patch-2209-99-0.sql (+15/-0)
lp://staging/~abrody/launchpad/https-mirror
Rejected for merging into lp://staging/launchpad
Colin Watson (community): Needs Fixing
Diff: 272 lines (+55/-19)
9 files modified
lib/lp/registry/browser/distributionmirror.py (+6/-5)
lib/lp/registry/configure.zcml (+4/-2)
lib/lp/registry/interfaces/distribution.py (+3/-3)
lib/lp/registry/interfaces/distributionmirror.py (+17/-2)
lib/lp/registry/model/distribution.py (+6/-3)
lib/lp/registry/model/distributionmirror.py (+9/-1)
lib/lp/registry/templates/distributionmirror-index.pt (+4/-0)
lib/lp/registry/templates/distributionmirror-macros.pt (+3/-1)
lib/lp/testing/factory.py (+3/-2)
~pappacena/launchpad:https-mirrors-2
Colin Watson (community): Approve
Diff: 1116 lines (+477/-53)
16 files modified
lib/lp/registry/browser/distributionmirror.py (+7/-6)
lib/lp/registry/browser/tests/distributionmirror-views.txt (+40/-9)
lib/lp/registry/configure.zcml (+5/-3)
lib/lp/registry/interfaces/distribution.py (+4/-4)
lib/lp/registry/interfaces/distributionmirror.py (+21/-3)
lib/lp/registry/model/distribution.py (+7/-4)
lib/lp/registry/model/distributionmirror.py (+10/-2)
lib/lp/registry/scripts/distributionmirror_prober.py (+153/-7)
lib/lp/registry/stories/webservice/xx-distribution-mirror.txt (+4/-0)
lib/lp/registry/stories/webservice/xx-distribution.txt (+1/-0)
lib/lp/registry/templates/distributionmirror-index.pt (+4/-0)
lib/lp/registry/templates/distributionmirror-macros.pt (+3/-1)
lib/lp/registry/tests/distributionmirror_http_server.py (+15/-7)
lib/lp/registry/tests/test_distributionmirror_prober.py (+196/-3)
lib/lp/scripts/utilities/importpedant.py (+3/-1)
lib/lp/testing/factory.py (+4/-3)
~pappacena/launchpad:https-mirrors
Colin Watson (community): Approve
Diff: 1116 lines (+477/-53)
16 files modified
lib/lp/registry/browser/distributionmirror.py (+7/-6)
lib/lp/registry/browser/tests/distributionmirror-views.txt (+40/-9)
lib/lp/registry/configure.zcml (+5/-3)
lib/lp/registry/interfaces/distribution.py (+4/-4)
lib/lp/registry/interfaces/distributionmirror.py (+21/-3)
lib/lp/registry/model/distribution.py (+7/-4)
lib/lp/registry/model/distributionmirror.py (+10/-2)
lib/lp/registry/scripts/distributionmirror_prober.py (+153/-7)
lib/lp/registry/stories/webservice/xx-distribution-mirror.txt (+4/-0)
lib/lp/registry/stories/webservice/xx-distribution.txt (+1/-0)
lib/lp/registry/templates/distributionmirror-index.pt (+4/-0)
lib/lp/registry/templates/distributionmirror-macros.pt (+3/-1)
lib/lp/registry/tests/distributionmirror_http_server.py (+15/-7)
lib/lp/registry/tests/test_distributionmirror_prober.py (+196/-3)
lib/lp/scripts/utilities/importpedant.py (+3/-1)
lib/lp/testing/factory.py (+4/-3)

CVE References

William Grant (wgrant)
Changed in launchpad:
importance: Undecided → Low
status: New → Triaged
tags: added: mirror
Revision history for this message
Hans-Christoph Steiner (eighthave) wrote :

Given bugs like CVE-2016-1252 https://www.debian.org/security/2016/dsa-3733, I think it is now quite clear that apt package archives should always use HTTPS. Right now, all of the Ubuntu repo sections are available via HTTPS:

* https://spout.ussg.indiana.edu/linux/ubuntu
* https://mirrors.kernel.org/ubuntu
* https://mirror.cse.unsw.edu.au/pub/ubuntu-releases/

Revision history for this message
Bryan Quigley (bryanquigley) wrote :

A very incomplete patch.. more like notes of changes I was testing midway - posting in case it's useful to someone else pursing this. http://pastebin.ubuntu.com/24793948/

Revision history for this message
kepler-211c (kepler-211c) wrote :

How is this bug set to low priority?

Yes, the packages are signed. However, signing keys can be stolen. Additionally there are bugs such as CVE-2016-1252 mentioned above.

In today's world, multiple layers of security are mandatory.

This is not a drill, could this please get some attention?

Revision history for this message
Bodo Brance (bodobr) wrote :

Please mark this bug as security issue.

Revision history for this message
Vivien GUEANT (vivienfr) wrote :

CVE-2019-3462 : Remote Code Execution in apt/apt-get
=> https://justi.cz/security/2019/01/22/apt-rce.html

Is-it possible to reference on https://launchpad.net/ubuntu/+mirror/bouygues-telecom hosting Ubuntu mirror in http secure (https in addition of http and rsync)

Would it be possible to remove ftp, which is an obsolete protocol, and to add the possibility to the mirrors that wish to propose https in addition to http?

Note that Debian will no longer offer FTP from 1 November 2017: https://www.debian.org/News/2017/20170425.en.html the FTP protocol is inefficient and requires adding awkward kludges to firewalls and load-balancing daemons.

Revision history for this message
Andy Brody (abrody) wrote :

Is anyone else interested in contributing or reviewing patches here? I'd like to see this implemented.

Bryan, is your patch at http://pastebin.ubuntu.com/24793948/ still a useful starting point or do you think it would be too stale at this point?

Revision history for this message
Bryan Quigley (bryanquigley) wrote :

It should at least hint at where changes would need to be made. I don't think it's changed that much since then.

Revision history for this message
Alex N. (a-nox) wrote :

Like mentioned above CVE-2019-3462 puts this topic back into focus. It would be great to see which mirror supports https.

Revision history for this message
Ben Atherton (benatherton) wrote :

I have recently switched my mirror over to HTTPS (with a redirect) and I am experiencing this issue, any timescales on this?

https://launchpad.net/ubuntu/+mirror/ubuntu.mirrors.benatherton.com-release

Revision history for this message
Thiago F. Pappacena (pappacena) wrote :

I'm continuing from Andy Brody's work in this merge proposal: https://code.launchpad.net/~pappacena/launchpad/+git/launchpad/+merge/379387

Changed in launchpad:
assignee: nobody → Thiago F. Pappacena (pappacena)
status: Triaged → In Progress
Revision history for this message
Vivien GUEANT (vivienfr) wrote :

Hello

Shouldn't the FTP protocol be removed?

It is obsolete and no longer used.

Vivien

Revision history for this message
Colin Watson (cjwatson) wrote :

@vivienfr: That's off-topic for this bug; and besides, there are lots of Ubuntu mirrors that still advertise FTP.

Revision history for this message
Colin Watson (cjwatson) wrote :

It's now possible to add HTTPS mirrors on production, but there's a remaining problem with the prober which isn't correctly talking HTTPS via the proxy that it uses. Thiago is working on this.

Thiago F. Pappacena (pappacena)
Changed in launchpad:
status: In Progress → Fix Committed
Colin Watson (cjwatson)
Changed in launchpad:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.