Skip to content

Flutter Maven repository should support HTTPS #47452

Closed
@GerritKopp

Description

@GerritKopp

The Flutter Maven repository (download.flutter.io) can't be accessed via HTTPS because of a certificate error (wrong host). In my opinion you should be able to download the artifacts via HTTPS for security reasons. Is the repository available via another URL or can the certificate error be fixed?

Activity

added
platform-androidAndroid applications specifically
and removed
c: new featureNothing broken; request for a new capability
on Dec 19, 2019
dnfield

dnfield commented on Dec 19, 2019

@dnfield
Contributor

@blasten @kf6gpe - we need to fix the certificate attached to download.flutter.io/download.flutter.dev. Looks like it's using the one for *.storage.googleapis.com, which triggers a bunch of warnings/errors over HTTPS.

added
t: gradle"flutter build" and "flutter run" on Android
a: existing-appsIntegration with existing apps via the add-to-app flow
on Dec 19, 2019
added this to the Near-term Goals milestone on Dec 19, 2019
blasten

blasten commented on Dec 23, 2019

@blasten

+1. GCP storage only supports CNAME entries for custom domains, which doesn't allow HTTPS.
https://cloud.google.com/storage/docs/troubleshooting#https

If we think this is critical, then we might either need to migrate to Firebase hosting as suggested in the GCP storage doc or drop the custom domain and use https://storage.googleapis.com/download.flutter.io directly.

dnfield

dnfield commented on Dec 23, 2019

@dnfield
Contributor

Would the setting up a load balancer option work out for us?

I think we should probably avoid firebase hosting for this - it will become tedious as we add more and more files (AFAIK it requires a complete local copy of your static assets to compare/upload - there's no way to just say "add these new assets").

If a load balancer doesn't work, I'd vote for just using the storage.googleapis.com domain directly. Will that have any negative impact on Chinese customers though?

added
toolAffects the "flutter" command-line tool. See also t: labels.
on Jan 3, 2020
skyred

skyred commented on Feb 2, 2020

@skyred

any negative impact on Chinese customers though

Cannot speak for the future, but currently https://storage.googleapis.com/download.flutter.io works in China.

dnfield

dnfield commented on Feb 2, 2020

@dnfield
Contributor

@blasten what would it take to just use storage.googleapis directly?

blasten

blasten commented on Feb 4, 2020

@blasten

very easily.

and
private static final String MAVEN_REPO = "http://download.flutter.io";

jmagman

jmagman commented on Mar 5, 2020

@jmagman
Member

Docs and sample updated.
flutter/website#3768
flutter/samples#355

github-actions

github-actions commented on Aug 16, 2021

@github-actions

This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

locked as resolved and limited conversation to collaborators on Aug 16, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    a: existing-appsIntegration with existing apps via the add-to-app flowplatform-androidAndroid applications specificallyt: gradle"flutter build" and "flutter run" on AndroidtoolAffects the "flutter" command-line tool. See also t: labels.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Participants

      @xster@skyred@jmagman@blasten@GerritKopp

      Issue actions

        Flutter Maven repository should support HTTPS · Issue #47452 · flutter/flutter