HTTPS Downloads - Security Issue

[boktai1000]

I recently went to https://openwrt.org/toh/hwdata/linksys/linksys_wrt32x_v1_venom to grab the latest build for 32X and was hit with some "scary" error messages in the Edge browser about the fact that the links were over http:// to download

You can see here:
Firmware OpenWrt Install URL:

http://downloads.openwrt.org/releases/21.02.1/targets/mvebu/cortexa9/openwrt-21.02.1-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.img

Firmware OpenWrt Upgrade URL:

http://downloads.openwrt.org/releases/21.02.1/targets/mvebu/cortexa9/openwrt-21.02.1-mvebu-cortexa9-linksys_wrt32x-squashfs-sysupgrade.bin

Firmware OpenWrt snapshot Install URL:

http://downloads.openwrt.org/snapshots/targets/mvebu/cortexa9/openwrt-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.img

Firmware OpenWrt snapshot Upgrade URL:

http://downloads.openwrt.org/snapshots/targets/mvebu/cortexa9/openwrt-mvebu-cortexa9-linksys_wrt32x-squashfs-sysupgrade.bin

To replicate the issue, simply use Microsoft Edge (latest version) and attempt to download and you'll be hit with a security prompt that blocks the downloads.

[flygarn12]

I saw this also a couple of weeks ago when downloading 21.02.1 images. But since I download imagebuilder and verify them with the gpg public key downloaded when 21.02 branch was released I continued with the download.

[hnyman]

@tmomas

I thought that we currently had https links in the techdata / ToH pages ?

[tmomas]

Related:

• Firmware download links: http or https?
• Upgrading OpenWrt firmware using CLI

I'm open for suggestions.

[hnyman]

I think that the situation has changed a lot from year 2017 (the first thread), as currently both master and 21.02 already default for https with the opkg package downloads by the router itself. Routers have https support by default since August 2020 (due to WPA3 readiness).

build: add libustream and certs to default pkgs

opkg switch to https was also done in August 2020 by

build: switch VERSION_REPO to HTTPS

Support for 19.07 will soon end, and all further releases should support https.

Also desktop browsing in general is nowadays largely https based, so I see no special reason why we should stick to promoting http downloads any more.

[tmomas]

OK, I will take care of changing the dataentries from http -> https during the next days.

[anon89577378]

My vote -

Upgrading OpenWrt firmware using CLI

OpenWrt server no longer allows http for images. As the error message says, you need to install libustream-wolfssl and ca-bundle to enable https support to wget. This requires about 1 MB of flash space. wolfssl is the smallest option if you don't already have another ssl library. If something depending on for example openssl is already installed, use libustream-openssl. Technically you don't need ca-bundle, as you can choose not to verify the server certificate with --no-check-certificate, …

[tmomas]

FYI - https links will be visible in the ToH within the next 15..30min.

Edit: Done.