Changes between Version 1 and Version 2 of Ticket #60418, comment 13


Ignore:
Timestamp:
May 5, 2020, 6:31:10 PM (4 years ago)
Author:
kencu (Ken)
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #60418, comment 13

    v1 v2  
    11So generally speaking a macports installation does not need to use the source files from <https://distfiles.macports.org>. The Portfile contains the full information to download the source code from the original URL. So if the source is missing from distfiles.macport.org, it makes no difference.
    22
    3 But it does to you, because you are on 10.5, and a stock MacPorts installation on 10.5 has very old TLS security capability, and most current source URLs, being https source URLs so malicious people don't get you to install crapola software instead of what you thought you were trying to install, most of these current source URLs will not work on your 10.5 macports installation. So you are unable to download any source code directly, and have to wait for the Portfile to be committed, and then one of Ryan's newer systems that does have current TLS security to download it for you form the origin URL, and then mirror it in MacPorts distfiles.macports.org, which has downgraded the TLS security so that you can use it.
     3But it does to you, because you are on 10.5, and a stock MacPorts installation on 10.5 has very old TLS security capability, and most current source URLs, being https source URLs so malicious people don't get you to install crapola software instead of what you thought you were trying to install, most of these current source URLs will not work on your 10.5 macports installation. So you are unable to download any source code directly, and have to wait for the Portfile to be committed, and then one of Ryan's newer systems that does have current TLS security to download it for you from the original URL, and then mirror it in MacPorts distfiles.macports.org, which has downgraded the TLS security so that you can use it.
    44
    55This works, but having downgraded TLS security is not ideal. But it is what it is, and that's why you only get your source code from the distfiles mirrors.