openwrt-mirror/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2026-06-17 17:01:44 +04:00
Code Issues Packages Projects Releases Wiki Activity

treewide: use HTTPS for PKG_SOURCE_URL where possible

Browse Source 
Switch http:// (and redundant ftp://) PKG_SOURCE_URL entries to https://
across tools/ and package/. PKG_HASH alone does not protect against an
attacker tampering with insecure downloads when a maintainer regenerates
the hash via `make ... FIXUP=1`: HTTPS authenticates the upstream so the
captured hash reflects real upstream content.

In-place http -> https (HTTPS reachability verified per host):
- tools/elftosb, tools/lzop, tools/liblzo, tools/mpfr, tools/dosfstools,
  tools/libressl, tools/xz
- package/libs/mpfr, package/libs/libmnl, package/libs/libnfnetlink

Replaced with @OPENWRT (HTTPS-only mirror) where the upstream HTTPS host
is dead or has a broken certificate:
- package/libs/popt (ftp.rpm.org cert mismatch)
- package/firmware/ixp4xx-microcode (was http://downloads.openwrt.org)
- package/boot/imx-bootlets (trabant.uid0.hu cert mismatch)
- package/boot/kobs-ng (freescale.com URL is dead, redirects to nxp.com root)

Dropped redundant ftp://ftp.denx.de fallback (https://ftp.denx.de is
already listed):
- package/boot/uboot-tools, tools/mkimage

Signed-off-by: Paul Spooren <mail@aparcar.org>
This commit is contained in:
Paul Spooren
2026-04-18 21:26:39 +08:00
parent e591ba4bad
commit 7a991c8d88
16 changed files with 18 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package/boot/imx-bootlets/Makefile
+1 -1
View File
@@ -10,7 +10,7 @@ PKG_NAME:=imx-bootlets
PKG_VERSION:=10.12.01
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://trabant.uid0.hu/openwrt/
PKG_SOURCE_URL:=@OPENWRT
PKG_HASH:=f7c98cbc41e15184cad61c56115e840e34ac3ebb4a162fadeea905e5038fd65b
PKG_FLAGS:=nonshared
package/boot/kobs-ng/Makefile
+1 -1
View File
@@ -12,7 +12,7 @@ PKG_VERSION:=5.4
PKG_RELEASE:=1
PKG_SOURCE:=imx-kobs-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://www.freescale.com/lgfiles/NMG/MAD/YOCTO/
PKG_SOURCE_URL:=@OPENWRT
PKG_HASH:=85171b46068ac47c42fedb8104167bf9afd33dd9527ed127e1ca2eb29d7a86bf
PKG_BUILD_DIR:=$(BUILD_DIR)/imx-kobs-$(PKG_VERSION)
package/boot/uboot-tools/Makefile
+1 -2
View File
@@ -7,8 +7,7 @@ PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_DISTNAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:= \
https://ftp.denx.de/pub/u-boot \
https://mirror.cyberbits.eu/u-boot \
ftp://ftp.denx.de/pub/u-boot
https://mirror.cyberbits.eu/u-boot
PKG_URL:=https://docs.u-boot.org/en/latest/
PKG_HASH:=ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd
PKG_SOURCE_SUBDIR:=$(PKG_DISTNAME)-$(PKG_VERSION)
package/firmware/ixp4xx-microcode/Makefile
+1 -1
View File
@@ -9,7 +9,7 @@ PKG_VERSION:=2.4
PKG_RELEASE:=1
PKG_SOURCE:=IPL_ixp400NpeLibraryWithCrypto-2_4.zip
PKG_SOURCE_URL:=http://downloads.openwrt.org/sources
PKG_SOURCE_URL:=@OPENWRT
PKG_HASH:=1b1170d0657847248589d946048c0aeaa9cd671966fc5bec5933283309485eaa
PKG_FLAGS:=nonshared
package/libs/libmnl/Makefile
+2 -2
View File
@@ -13,8 +13,8 @@ PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:= \
http://www.netfilter.org/projects/libmnl/files \
ftp://ftp.netfilter.org/pub/libmnl
https://www.netfilter.org/projects/libmnl/files \
https://ftp.netfilter.org/pub/libmnl
PKG_HASH:=274b9b919ef3152bfb3da3a13c950dd60d6e2bcd54230ffeca298d03b40d0525
PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
package/libs/libnfnetlink/Makefile
+2 -2
View File
@@ -13,8 +13,8 @@ PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:= \
http://www.netfilter.org/projects/libnfnetlink/files/ \
ftp://ftp.netfilter.org/pub/libnfnetlink/
https://www.netfilter.org/projects/libnfnetlink/files/ \
https://ftp.netfilter.org/pub/libnfnetlink/
PKG_HASH:=b064c7c3d426efb4786e60a8e6859b82ee2f2c5e49ffeea640cfe4fe33cbc376
PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
PKG_LICENSE:=GPL-2.0+
package/libs/mpfr/Makefile
+1 -1
View File
@@ -11,7 +11,7 @@ PKG_NAME:=mpfr
PKG_VERSION:=4.2.2
PKG_RELEASE:=1
PKG_SOURCE_URL:=@GNU/mpfr http://www.mpfr.org/mpfr-$(PKG_VERSION)
PKG_SOURCE_URL:=@GNU/mpfr https://www.mpfr.org/mpfr-$(PKG_VERSION)
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_HASH:=b67ba0383ef7e8a8563734e2e889ef5ec3c3b898a01d00fa0a6869ad81c6ce01
package/libs/popt/Makefile
+1 -1
View File
@@ -12,7 +12,7 @@ PKG_VERSION:=1.19
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://ftp.rpm.org/popt/releases/popt-1.x/
PKG_SOURCE_URL:=@OPENWRT
PKG_HASH:=c25a4838fc8e4c1c8aacb8bd620edb3084a3d63bf8987fdad3ca2758c63240f9
PKG_LICENSE:=MIT
PKG_CPE_ID:=cpe:/a:popt_project:popt