[tor-bugs] #8286 [Tor bundles/installation]: Fetch software during TBB build process only over trusted HTTPS

[Tor Bug Tracker & Wiki]

#8286: Fetch software during TBB build process only over trusted HTTPS
--------------------------------------+-------------------------------------
 Reporter:  ioerror                   |          Owner:  erinn       
     Type:  enhancement               |         Status:  needs_review
 Priority:  major                     |      Milestone:              
Component:  Tor bundles/installation  |        Version:              
 Keywords:                            |         Parent:  #8288       
   Points:                            |   Actualpoints:              
--------------------------------------+-------------------------------------

Comment(by mikeperry):

 This looks great and is almost ready to merge, except: Do we also want a
 cron script that runs on people that tells us if any of the mirrored
 source either changed or got new versions upstream?

 I want to avoid the situation where we switch to people.tp.org as our
 mirror, but then forget to ever update these packages. I think for
 most/all of them they simply remove the old version's tar when they
 release a new one, so the cron script could just email us when the version
 we have disappeared from upstream?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8286#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online