search

swig / www

Web pages at http://www.swig.org
10 stars 17 forks source link

Migrate from sourceforge.net to GitHub (ghcr.io or raw.githubusercontent.com) #17

Open imuhdork opened 5 months ago

imuhdork commented 5 months ago

Sourceforge.net and its mirrors currently host the swig brew formula and packages. Unfortunately, many organizations are blocking any downloads from sourceforge.net given various security concerns with the practices in that platform.

Many other packages and brew formula (especially) have migrated to the GitHub container registry (ghcr.io) or accessing the raw files directly from GitHub via raw.githubusercontent.com. Both of these options appear to be an industry trend with greater trust of the content. Please consider migrating where the swig package and formulae can be downloaded from Sourceforge to GitHub.

ojwb commented 5 months ago

I don't think we maintain the swig brew formula - that seems to be in the homebrew-core repo: https://github.com/Homebrew/homebrew-core/blob/0a816916dd912a9c7c3835cb0615ad6a0a24cc59/Formula/s/swig.rb

imuhdork commented 5 months ago

Could the brew formula you linked just be pointing to where the swig packages appear to be uploaded as defined in https://github.com/swig/swig/blob/master/Tools/mkrelease.py? It looks like swig packages are available from sourceforge in general and brew formula are just using just using that package location.

ojwb commented 5 months ago

Our website is hosted on sourceforge currently, but that isn't what you asked us to change.

Moving to the appropriate tracker.

Unfortunately, many organizations are blocking any downloads from sourceforge.net given various security concerns with the practices in that platform.

Can you provide evidence for this claim?

imuhdork commented 4 months ago

Perhaps it stems from this event which is further explained in this article. The article outlines that sourceforge had allegedly been wrapping download packages with adware and allowing misleading adware to spoof downloads with fake download buttons. As a result, Chrome ad blockers and anti virus software publicly acknowledged blocking sourceforge.

Admittedly, much of this stems from a decade old practice that SourceForge has changed for the better. Additionally, after reviewing the past issues in swig I see this may actually be a duplicate request. Even with all of that though, it SEEMS like the trustworthiness of sourceforge is still mixed while github has gained traction and market comparatively.