Re: [Qemu-devel] [PATCH web 0/2] Secure the download links and more

[Paolo Bonzini]

On 04/09/2017 16:26, Daniel P. Berrange wrote:
> Peter pointed out a bit of a crazy setup:
> 
> The front page link to the 2.10.0 tarball is
> 
>   http://download.qemu-project.org/qemu-2.10.0.tar.xz
> 
> which gets you a 301 redirect to
> 
>   http://download.qemu.org/qemu-2.10.0.tar.xz
> 
> which gets you a 301 redirect to
> 
>   https://download.qemu.org/qemu-2.10.0.tar.xz...
> 
> which gives the $BAD guys plenty chance to compromise your
> download. Fix this to link to https:// sites exclusively
> and use the preferred qemu.org domani too. All links are
> fixed to use https, not merely download site links.
> 
> Daniel P. Berrange (2):
>   Update all links to prefer qemu.org over qemu-project.org
>   Use https links whereever possible
> 
>  .htaccess                                            |  6 +++---
>  _download/source.html                                | 12 ++++++------
>  _includes/footer.html                                | 18 +++++++++---------
>  _includes/releases.html                              |  8 ++++----
>  _posts/2017-02-04-the-new-qemu-website-is-up.md      | 10 +++++-----
>  _posts/2017-03-19-qemu-in-the-blogs-february-2017.md |  4 ++--
>  _posts/2017-08-10-deprecation.md                     |  2 +-
>  contribute.md                                        |  8 ++++----
>  contribute/report-a-bug.md                           |  6 +++---
>  documentation.md                                     |  8 ++++----
>  index.html                                           |  2 +-
>  11 files changed, 42 insertions(+), 42 deletions(-)
> 

Queued, including changes to the 2.10.0 blog post in patch 2.  Will push
tomorrow.

Paolo