{"action":"created","issue":{"url":"https://api.github.com/repos/Homebrew/homebrew/issues/36711","labels_url":"https://api.github.com/repos/Homebrew/homebrew/issues/36711/labels{/name}","comments_url":"https://api.github.com/repos/Homebrew/homebrew/issues/36711/comments","events_url":"https://api.github.com/repos/Homebrew/homebrew/issues/36711/events","html_url":"https://github.com/Homebrew/homebrew/issues/36711","id":57235071,"number":36711,"title":"Disable by default downloading source from insecure URLs","user":{"login":"dgouldin","id":55577,"avatar_url":"https://avatars.githubusercontent.com/u/55577?v=3","gravatar_id":"","url":"https://api.github.com/users/dgouldin","html_url":"https://github.com/dgouldin","followers_url":"https://api.github.com/users/dgouldin/followers","following_url":"https://api.github.com/users/dgouldin/following{/other_user}","gists_url":"https://api.github.com/users/dgouldin/gists{/gist_id}","starred_url":"https://api.github.com/users/dgouldin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dgouldin/subscriptions","organizations_url":"https://api.github.com/users/dgouldin/orgs","repos_url":"https://api.github.com/users/dgouldin/repos","events_url":"https://api.github.com/users/dgouldin/events{/privacy}","received_events_url":"https://api.github.com/users/dgouldin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-02-10T20:54:16Z","updated_at":"2015-02-10T22:11:39Z","closed_at":null,"body":"When SF's cert busted today, I found homebrew falling back to installing from source :+1: and using non-tls urls to do so :-1:. Can allowing source from an insecure url be an override rather than the default? I'd rather users have to load that gun themselves."},"comment":{"url":"https://api.github.com/repos/Homebrew/homebrew/issues/comments/73795168","html_url":"https://github.com/Homebrew/homebrew/issues/36711#issuecomment-73795168","issue_url":"https://api.github.com/repos/Homebrew/homebrew/issues/36711","id":73795168,"user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"created_at":"2015-02-10T22:11:39Z","updated_at":"2015-02-10T22:11:39Z","body":"> When SF's cert busted today, \r\n\r\nSourceforge fairly frequently redirects to mirrors that aren't guarded by TLS. It's a little unfair to hold up SF as a standard that should be met without highlighting that small nit.\r\n\r\nThe SSL/TLS situation is something that is being improved. Where upstream SSL/TLS links are available, they should be switched as new PRs are submitted. SSL link auditing is something ` brew audit ` actually does for a host of popular links. It'd be awesome if Homebrew had the power to convince upstreams to adopt strong TLS protection for their websites and particularly download links, but alas.\r\n\r\nIt's not a bug to use an insecure download link when that is all upstream offer, and I think making blocking that capability the default would be a massive regression in usability for Homebrew. Not against an option, but I think making it the default is asking for misery.\r\n\r\n> or gain GH credentials for a user whose pull you'd trust.\r\n\r\nThis wouldn't work, unless you also compromised the test bot. The Bot checks the given SHA itself, and will raise a fatal testing error if it detects a mismatch. So likely the PR would have to come from a compromised maintainer *and* be verified by a compromised test bot for it to be accepted. It's not as simple as just compromising an account of a regular contributor or someone trusted.\r\n"}}