this post was submitted on 02 May 2024
116 points (96.8% liked)

Open Source

31205 readers
207 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
116
OpenSSL goes GitHub only (openssl.org)
submitted 6 months ago* (last edited 6 months ago) by [email protected] to c/[email protected]
53 comments fedilink hide all child comments
 

We’re no longer using our old ftp, rsync, and git links for distributing OpenSSL. These were great in their day, but it’s time to move on to something better and safer. ftp://ftp.openssl.org and rsync://rsync.openssl.org are not available anymore. As of June 1, 2024, we’re also going to shut down https://ftp.openssl.org and git://git.openssl.org/openssl.git mirrors.

GitHub is becoming the main distributor of the OpenSSL releases.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 5 points 6 months ago* (last edited 6 months ago) (2 children)

Any official mirrors would sync the changes anyway, it’s automatic

Edit: Oh, I think I misunderstood your point. I agree that hosting the repos themselves would make it harder for randoms to maliciously introduce code

[–] [email protected] 2 points 6 months ago (1 children)

What is your definition of harder? I think bugs/breaches are even more likely on personal forges than github. Not that one should rely on github anyways...

[–] [email protected] 2 points 6 months ago

I agree

[–] [email protected] 5 points 6 months ago (1 children)

I was trying to say that if the OpenSSL developers upload new source code to only GitHub and something goes wrong, even for example simply a mistake or failure by GitHub, then other users wanting to download will not have to wait for the OpenSSL developers to repair that problem when OpenSSL project would for example have mirrors on Codeberg or sourcehut or their own git server, the latter which they intend to deprecate.

[–] [email protected] 3 points 6 months ago (1 children)

If they were to set up an official mirror it would be automatic, so I don’t think there’s any real way to avoid that problem with their current plan. But you’re right! Sorry for the confusion