Commit 4a4e9661 authored by David Beitey's avatar David Beitey Committed by Julien Muchembled

Use HTTPS for PyPI index

PyPI redirects HTTP to HTTPS by default now so using HTTPS directly
avoids the potential for that redirect being modified in flight,
helping prevent MITM attacks.

Fixes #114.

(cherry picked from commit fac9979f516fe1b080258f9b367401a8cc1832e8)
parent 340b9f86
......@@ -3065,9 +3065,9 @@ using the `index` option::
[buildout]
...
index = http://index.example.com/
index = https://index.example.com/
This index, or the default of http://pypi.python.org/simple/ if no
This index, or the default of https://pypi.python.org/simple/ if no
index is specified, will always be searched for distributions unless
running buildout with options that prevent searching for
distributions. The latest version of the distribution that meets the
......
......@@ -46,7 +46,7 @@ def realpath(path):
default_index_url = os.environ.get(
'buildout-testing-index-url',
'http://pypi.python.org/simple',
'https://pypi.python.org/simple',
)
logger = logging.getLogger('zc.buildout.easy_install')
......
......@@ -46,7 +46,7 @@ index
The URL of an index server, or almost any other valid URL. :)
If not specified, the Python Package Index,
http://pypi.python.org/simple/, is used. You can specify an
https://pypi.python.org/simple/, is used. You can specify an
alternate index with this option. If you use the links option and
if the links point to the needed distributions, then the index can
be anything and will be largely ignored. In the examples, here,
......@@ -1073,7 +1073,7 @@ index
The URL of an index server, or almost any other valid URL. :)
If not specified, the Python Package Index,
http://pypi.python.org/simple/, is used. You can specify an
https://pypi.python.org/simple/, is used. You can specify an
alternate index with this option. If you use the links option and
if the links point to the needed distributions, then the index can
be anything and will be largely ignored. In the examples, here,
......
......@@ -324,8 +324,8 @@ When everything is pinned, no output is generated:
...
The Python package index is case-insensitive. Both
http://pypi.python.org/simple/Django/ and
http://pypi.python.org/simple/dJaNgO/ work. And distributions aren't always
https://pypi.python.org/simple/Django/ and
https://pypi.python.org/simple/dJaNgO/ work. And distributions aren't always
naming themselves consistently case-wise. So all version names are normalized
and case differences won't impact the pinning:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment