The download links for project release tarballs and zip files point to http://ftp.drupal.org - however https://ftp.drupal.org seems to serve the same content and has a valid certificate, any reason not to link there instead?

Comments

John Morahan created an issue. See original summary.

drumm’s picture

drumm
he/him
Location NY, US
CreditAttribution: drumm at Drupal Association commented

The configuration for this, drush vset project_release_download_base_project_release … is straightforward to change, and will also affect update XML. Before changing this, we should double check that supported versions of Drupal handle this okay.

drumm’s picture

drumm
he/him
Location NY, US
CreditAttribution: drumm at Drupal Association commented

I think this may only need to be tested in Drupal 7 & 8: https://api.drupal.org/api/drupal/core%21modules%21update%21update.manag....

And this would need proper announcements as well.

basic’s picture

basic CreditAttribution: basic at Drupal Association commented

+1 to doing this, I believe recent versions of Drush have been using the https enabled ftp.d.o for the last few releases already. Lets schedule for next week, mid-week.

John Morahan’s picture

John Morahan CreditAttribution: John Morahan as a volunteer commented
Status: Active » Fixed

Looks like this was fixed in #2646270: SSL for downloads from ftp.drupal.org and for updates.drupal.org itself.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.