search

chainguard-dev / go-apk

native go library for installation and management of apk packages
Apache License 2.0
29 stars 29 forks source link

http scheme for repository is not supported #91

Closed aohoyd closed 1 year ago

aohoyd commented 1 year ago

Hi! I'm trying to adopt melange and apko for our build processes and found an issue which stops me from that. It is not currently possible to use apk repository with http scheme, index just ignored.

I found that http is ignored in https://github.com/chainguard-dev/go-apk/blob/36d0bc2cdc194fbabf5715c2404f5e5bdab4ca62/pkg/apk/index.go#L97, is it by design? I'm going to submit PR but not sure that you'll accept it because of insecure scheme:) Is it ok to also use insecure channel?

Elizafox commented 1 year ago

Discussing this with other engineers at the company, I don't think we want to support non-HTTPS repos. If someone says otherwise I will reopen this.

Lets Encrypt can meet your certificate needs.