{"action":"created","issue":{"url":"https://api.github.com/repos/milkypostman/melpa/issues/2109","labels_url":"https://api.github.com/repos/milkypostman/melpa/issues/2109/labels{/name}","comments_url":"https://api.github.com/repos/milkypostman/melpa/issues/2109/comments","events_url":"https://api.github.com/repos/milkypostman/melpa/issues/2109/events","html_url":"https://github.com/milkypostman/melpa/issues/2109","id":46715609,"number":2109,"title":"Support HTTPS","user":{"login":"purcell","id":5636,"avatar_url":"https://avatars.githubusercontent.com/u/5636?v=3","gravatar_id":"","url":"https://api.github.com/users/purcell","html_url":"https://github.com/purcell","followers_url":"https://api.github.com/users/purcell/followers","following_url":"https://api.github.com/users/purcell/following{/other_user}","gists_url":"https://api.github.com/users/purcell/gists{/gist_id}","starred_url":"https://api.github.com/users/purcell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/purcell/subscriptions","organizations_url":"https://api.github.com/users/purcell/orgs","repos_url":"https://api.github.com/users/purcell/repos","events_url":"https://api.github.com/users/purcell/events{/privacy}","received_events_url":"https://api.github.com/users/purcell/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/milkypostman/melpa/labels/website","name":"website","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":40,"created_at":"2014-10-24T08:36:31Z","updated_at":"2015-08-24T18:14:48Z","closed_at":null,"body":"We've previously declined to provide this (see #1877) on the basis that signing packages (#1749) is the long-term path to ensuring tamper-evident installations.\r\n\r\nHowever, signing will only benefit those with Emacs 24.4 or greater, and now that we've settled MELPA on a dedicated TLD we can easily get a (free) SSL cert. So let's do that.\r\n\r\nThoughts:\r\n\r\n- StartSSL provides free certs for a TLD and one subdomain (usually \"www.\", but \"stable.\" in our case)\r\n- CloudFlare would proxy and SSL the sites for free, but this would stop us from calculating download statistics\r\n- If we go SSL-only, which we should, then we need to be prepared for problems when users' Emacsen do not have access to the `open_ssl` or `gnutls` helper programs. This seems to have affected Windows users following Marmalade's switch to SSL-only.\r\n\r\nSuggested steps:\r\n\r\n- @milkypostman verifies his own identity with StartSSL using a `@melpa.org` email address\r\n- @milkypostman obtains a free cert using that verified identity\r\n- Either one of us sets up the cert in `nginx` on the servers, and probably enables SPDY too. I've done this a bunch, so can easily take care of this.\r\n- We update the \"getting started\" page and README to recommend HTTPS, and start using that URL ourselves.\r\n- When ready, 301 the HTTP URLs to HTTPS.\r\n\r\nTo check:\r\n\r\n- Protocol changes are considered a domain change by Webmaster Tools, because you could technically run completely different sites on `https:` and `http:`. Can't recall if there's an effect on Google Analytics, dlvr.it etc., but it's worth looking out for.\r\n\r\n/cc @technomancy (thanks for the prod)"},"comment":{"url":"https://api.github.com/repos/milkypostman/melpa/issues/comments/134323217","html_url":"https://github.com/milkypostman/melpa/issues/2109#issuecomment-134323217","issue_url":"https://api.github.com/repos/milkypostman/melpa/issues/2109","id":134323217,"user":{"login":"glyph","id":716529,"avatar_url":"https://avatars.githubusercontent.com/u/716529?v=3","gravatar_id":"","url":"https://api.github.com/users/glyph","html_url":"https://github.com/glyph","followers_url":"https://api.github.com/users/glyph/followers","following_url":"https://api.github.com/users/glyph/following{/other_user}","gists_url":"https://api.github.com/users/glyph/gists{/gist_id}","starred_url":"https://api.github.com/users/glyph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glyph/subscriptions","organizations_url":"https://api.github.com/users/glyph/orgs","repos_url":"https://api.github.com/users/glyph/repos","events_url":"https://api.github.com/users/glyph/events{/privacy}","received_events_url":"https://api.github.com/users/glyph/received_events","type":"User","site_admin":false},"created_at":"2015-08-24T18:14:48Z","updated_at":"2015-08-24T18:14:48Z","body":"Only users on Linux do, and only if they have particular packages installed (`ca-certificates` on debian, not sure what it is on fedora)."}}