You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@airavata.apache.org by "Jayanth Vennamreddy (Jira)" <ji...@apache.org> on 2026/03/17 05:05:00 UTC
[jira] [Comment Edited] (AIRAVATA-3882) airavata uses insecure http endpoints to access jars in its builds
[ https://issues.apache.org/jira/browse/AIRAVATA-3882?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18066241#comment-18066241 ]
Jayanth Vennamreddy edited comment on AIRAVATA-3882 at 3/17/26 5:04 AM:
------------------------------------------------------------------------
alright i've investigated this issue across the referenced repositories.
the core airavata repo has already been updated on master, and airavata-custos no longer contains the affected Ansible roles since this issue has been posted.
However, airavata-data-lake still contains two insecure HTTP download URLs (Kafka and Zookeeper roles).
I’ll submit a PR to update those to HTTPS.
edit:
I inspected the current master branch of apache/airavata-data-lake, and the artifact download URLs in:
•ansible/roles/kafka/defaults/main.yml
•ansible/roles/zookeeper/vars/main.yml
are already using HTTPS.
seems like the issue is resolved on master. Please confirm if this ticket can be closed.
was (Author: JIRAUSER312747):
alright i've investigated this issue across the referenced repositories.
the core airavata repo has already been updated on master, and airavata-custos no longer contains the affected Ansible roles since this issue has been posted.
However, airavata-data-lake still contains two insecure HTTP download URLs (Kafka and Zookeeper roles).
I’ll submit a PR to update those to HTTPS.
> airavata uses insecure http endpoints to access jars in its builds
> ------------------------------------------------------------------
>
> Key: AIRAVATA-3882
> URL: https://issues.apache.org/jira/browse/AIRAVATA-3882
> Project: Airavata
> Issue Type: Bug
> Reporter: PJ Fanning
> Priority: Major
>
> Dependency Injection is a major concern.
> * https://github.com/apache/airavata-data-lake/blob/e1d6fc8fc794547a92ba0b5689a0402fb13d0447/ansible/roles/kafka/defaults/main.yml#L24
> * https://github.com/apache/airavata-custos/blob/ecc57c3108e1f86cc27cb920a1dd777103eaccea/ansible/roles/kafka/defaults/main.yml#L24
> * https://github.com/apache/airavata/blob/9e077f93851c2a3b89c1b586aa63b651a777b13a/dev-tools/ansible/roles/kafka/defaults/main.yml#L25
--
This message was sent by Atlassian Jira
(v8.20.10#820010)