packages icon indicating copy to clipboard operation
packages copied to clipboard

Packages with insecure `http` or dead link as homepage

Open malfisya opened this issue 7 months ago • 12 comments

There are packages in our repository that is not using https in homepage and source keys. We need to fix it.

You can also check the list of packages with http homepage yourself using rg:

# Go to your local clone of packages repository
rg --files-with-matches "homepage\s*:\s*http:" -g '*package.yml'

Guidance on fixing

  • Refer to our help site if you are new to packaging and need to set up your system: https://help.getsol.us/docs/packaging/prepare-for-packaging
  • homepage goes after source, see https://help.getsol.us/docs/packaging/package.yml. Some existing package.yml will have homepage in other places; don't worry about that
  • If the homepage uses http replace it with https, make sure the https homepage works
  • If an appropriate website exists for the package then that may be used
  • If the package does not have the appropriate website, it should be replaced with the upstream git repository link.
    • Example: the homepage for four-in-a-row should be moved to https://gitlab.gnome.org/GNOME/four-in-a-row from https://wiki.gnome.org/Apps/Four-in-a-row as no other website exists.
  • BONUS POINT Make sure that the source key is not http
  • After you have replaced the homepage, rebuild the package. This checks that the homepage was added correctly.
  • One Pull Request for each package
  • If you would like to fix many packages you can pick a letter and fix packages starting with that letter

List

  • 192 packages
  • https://gist.github.com/malfisya/ffec312263d1dca259af75ac36a874ef

malfisya avatar Apr 26 '25 03:04 malfisya