Commit 4a4e9661 authored by David Beitey's avatar David Beitey Committed by Julien Muchembled

Use HTTPS for PyPI index

PyPI redirects HTTP to HTTPS by default now so using HTTPS directly
avoids the potential for that redirect being modified in flight,
helping prevent MITM attacks.

Fixes #114.

(cherry picked from commit fac9979f516fe1b080258f9b367401a8cc1832e8)
parent 340b9f86
...@@ -3065,9 +3065,9 @@ using the `index` option:: ...@@ -3065,9 +3065,9 @@ using the `index` option::
[buildout] [buildout]
... ...
index = http://index.example.com/ index = https://index.example.com/
This index, or the default of http://pypi.python.org/simple/ if no This index, or the default of https://pypi.python.org/simple/ if no
index is specified, will always be searched for distributions unless index is specified, will always be searched for distributions unless
running buildout with options that prevent searching for running buildout with options that prevent searching for
distributions. The latest version of the distribution that meets the distributions. The latest version of the distribution that meets the
......
...@@ -46,7 +46,7 @@ def realpath(path): ...@@ -46,7 +46,7 @@ def realpath(path):
default_index_url = os.environ.get( default_index_url = os.environ.get(
'buildout-testing-index-url', 'buildout-testing-index-url',
'http://pypi.python.org/simple', 'https://pypi.python.org/simple',
) )
logger = logging.getLogger('zc.buildout.easy_install') logger = logging.getLogger('zc.buildout.easy_install')
......
...@@ -46,7 +46,7 @@ index ...@@ -46,7 +46,7 @@ index
The URL of an index server, or almost any other valid URL. :) The URL of an index server, or almost any other valid URL. :)
If not specified, the Python Package Index, If not specified, the Python Package Index,
http://pypi.python.org/simple/, is used. You can specify an https://pypi.python.org/simple/, is used. You can specify an
alternate index with this option. If you use the links option and alternate index with this option. If you use the links option and
if the links point to the needed distributions, then the index can if the links point to the needed distributions, then the index can
be anything and will be largely ignored. In the examples, here, be anything and will be largely ignored. In the examples, here,
...@@ -1073,7 +1073,7 @@ index ...@@ -1073,7 +1073,7 @@ index
The URL of an index server, or almost any other valid URL. :) The URL of an index server, or almost any other valid URL. :)
If not specified, the Python Package Index, If not specified, the Python Package Index,
http://pypi.python.org/simple/, is used. You can specify an https://pypi.python.org/simple/, is used. You can specify an
alternate index with this option. If you use the links option and alternate index with this option. If you use the links option and
if the links point to the needed distributions, then the index can if the links point to the needed distributions, then the index can
be anything and will be largely ignored. In the examples, here, be anything and will be largely ignored. In the examples, here,
......
...@@ -324,8 +324,8 @@ When everything is pinned, no output is generated: ...@@ -324,8 +324,8 @@ When everything is pinned, no output is generated:
... ...
The Python package index is case-insensitive. Both The Python package index is case-insensitive. Both
http://pypi.python.org/simple/Django/ and https://pypi.python.org/simple/Django/ and
http://pypi.python.org/simple/dJaNgO/ work. And distributions aren't always https://pypi.python.org/simple/dJaNgO/ work. And distributions aren't always
naming themselves consistently case-wise. So all version names are normalized naming themselves consistently case-wise. So all version names are normalized
and case differences won't impact the pinning: and case differences won't impact the pinning:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment