New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Serve website as https #5

Open
moschlar opened this Issue Aug 12, 2015 · 4 comments

Comments

Projects
None yet
4 participants
@moschlar
Contributor

moschlar commented Aug 12, 2015

Hi there,

would it be possible to activate https for the TG2 website?
The main reason would be for the download archives, since new versions of pip will warn and deny to download from non-https index urls.

Example:

$ travis_retry pip install --download-cache=$HOME/.pip-cache -i http://tg.gy/${TG2_VERSION//./}/ TurboGears2
[...]
Collecting TurboGears2
  DEPRECATION: Failed to find 'TurboGears2' at http://tg.gy/current/turbogears2/. It is suggested to upgrade your index to support normalized names as the name in /simple/{name}.
  This repository located at tg.gy is not a trusted host, if this repository is available via HTTPS it is recommend to use HTTPS instead, otherwise you may silence this warning with '--trusted-host tg.gy'.
  DEPRECATION: Implicitly allowing locations which are not hosted at a secure origin is deprecated and will require the use of --trusted-host in the future.
  Could not find any downloads that satisfy the requirement TurboGears2
  No distributions at all found for TurboGears2

(https://travis-ci.org/moschlar/SAUCE/jobs/75221597)

Of course I just added the --trusted-host parameter for now, but I think that warning is there for a good reason. ;)

Thanks,
Moritz

@amol-

This comment has been minimized.

Show comment
Hide comment
@amol-

amol- Aug 12, 2015

Member

Uhm, I suppose pip requires a valid SSL cert, so we would need to buy a real SSL cert.
As this is something that happens only for TG < 2.3 as since 2.3 private index is not used anymore, I'm not sure it would make sense to invest the money for a version that should see users diminishing.

I'll have a look and see if we can find a solution that is affordable and solves the problem for users.

Member

amol- commented Aug 12, 2015

Uhm, I suppose pip requires a valid SSL cert, so we would need to buy a real SSL cert.
As this is something that happens only for TG < 2.3 as since 2.3 private index is not used anymore, I'm not sure it would make sense to invest the money for a version that should see users diminishing.

I'll have a look and see if we can find a solution that is affordable and solves the problem for users.

@moschlar

This comment has been minimized.

Show comment
Hide comment
@moschlar

moschlar Aug 12, 2015

Contributor

What about a free one from StartSSL?

Contributor

moschlar commented Aug 12, 2015

What about a free one from StartSSL?

@Cito

This comment has been minimized.

Show comment
Hide comment
@Cito

Cito Aug 12, 2015

Contributor

Or one from https://letsencrypt.org/ if it can wait a few months.

Contributor

Cito commented Aug 12, 2015

Or one from https://letsencrypt.org/ if it can wait a few months.

@OriginalPenguin

This comment has been minimized.

Show comment
Hide comment
@OriginalPenguin

OriginalPenguin Jun 4, 2018

This would be nice to see happen now...

OriginalPenguin commented Jun 4, 2018

This would be nice to see happen now...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment