update notifications: download not supporting https

[MichaelMerkel]

hi.

today the update notification window showed three updates (codesets, openurl, thebar).
but i cannot download them.
selection either of them and pressing the "download update" button asks for the local path/file. then the transfer window shows.
bit it does not download. instead it always switches the status from "Baue Verbindung zu Server auf" to "Warte auf Antwort vom Server". and this goes endless.
i only can cancel the tranfser.

this is with 2.10dev (OS4/PPC) 30.07.2016

(btw - would be nice to be able to select the text of the version number in the about window! :-))

thanks and regards...
michael

[jens-maus]

This is certainly due to the strong/modern SSL ciphers github is using to encrypt its connections and AmiSSL in its current version cannot deal with this (Amiga stuff is always too old!). So please take your web browser and download the stuff manually.

[MichaelMerkel]

already downloaded and installed.
so does this mean the yam download functionality is useless currently? :-(
(if connected to github)

regards...
michael

[jens-maus]

I think so, indeed (like 99% of software on AmigaOS 😀) my simple guess is that the download functionality currently can't deal with https at all...

[jens-maus]

After some short investigation I could verify that the corresponding function which performs the HTTP download doesn't simply not allow to perform HTTPS connections:

https://github.com/jens-maus/yam/blob/master/src/tcp/http.c#L199

So, to get the new github download links working we have to implement https support in the DownloadURL() function.

[HKvalhe]

I also experienced the same issue with YAM 2.10 dev version, trying to download the 3 updates (OpenURL, TheBar.mcc and Codesets) from GitHub.com. The server struggles heavily to connect and it takes forever, meaning the updates can't be downloaded at all.

However, several here seem to point to HTTP vs HTTPS as the issue for why the updates can't be downloaded. Please fix this issue. It's very annoying not to be able to download these important updates.

I have provided an attachment of a screenshot showing the issue...

[jens-maus]

As soon as we have time we will implement https support. In the meantime use your webrowser please to download these archives.

[HKvalhe]

Thanks but where on webbrowser to find these archives? Update: I found them! Had to search for topics related to the 3 different files one by one...

[jens-maus]

Well, just enter the URLs YAM is showing you in a webbrowser ton download the archives.

[MichaelMerkel]

Hi Jens.
How about adding a context menu to the download entries? Like "open link in web browser" or simply double clicking the entry? Soumds like a quick win feature to me?
Thanks and regards
Michael
Am 06.08.2016 3:30 nachm. schrieb Jens Maus [email protected]:Well, just enter the URLs YAM is showing you in a webbrowser ton download the archives.

—You are receiving this because you authored the thread.Reply to this email directly, view it on GitHub, or mute the thread.

[jeffv03]

Hello Jens

On 05/08/2016, you wrote:

After some short investigation I could verify that the corresponding function which performs the HTTP download doesn't
simply not allow to perform HTTPS connections:

https://github.com/jens-maus/yam/blob/master/src/tcp/http.c#L199

So, to get the new github download links working we have to implement https support in the DownloadURL() function.

Just a question, why not using the openurl stuff for the updates ?

Amigalement,
JF

[jens-maus]

Sorry Thore, but I have to reopen this ticket again because IMHO:

1. a proper fix would be to implement https support
2. to put a normal button on the update window beside the download button rather than hiding things via a context menu.

[jens-maus]

Thanks for the modifications, Thore. However, I will still keep that ticket open to make sure we don't forget to implement https support some time soon.

[Hypexed]

I just noticed this issue. It appears to be downloading then goes into an endless loop. Obviously this goes beyond, OS4, my user plattform. Does it affect all platforms then?

For OS4 I think the best thing would be to issue the update through AmiUpdate. But, perhaps the MUI components should be downloaded from another site, such as Aminet? At least for public updates.

[jeffv03]

Hello Jens ^^)

Le 24/09/2016 à 11:33, Hypexed a écrit :

I just noticed this issue. It appears to be downloading then goes into
an endless loop. Obviously this goes beyond, OS4, my user plattform.
Does it affect all platforms then?

noticed this on OS4 so far...

For OS4 I think the best thing would be too issue the update through
AmiUpdate. But, perhaps the MUI components should be downloaded from
another site, such as Aminet? At least for public updates.

Amiupdate is meant to be "THE" tool for almost automaticaly updating
Amiga OSes, both for betatesters only and public updates (it's an opt-in
update system after all, you have to "subscribe" to the updates severs
you want to get updates from, beside the default public servers already
configured in) but still finding all public updates on Aminet or
OS4depot is important too ^^)

Amigalement,
JF

[Weber-Frank]

The download button is here (AOS 3.9 on A2000, using the latest YAM Version) diasabled. :-(
The context menu entry is not disabled and working (open AWeb and AWeb ask where to save the File)

[tboeckel]

I admit there is an inconsistency between the button and the context menus. I will fix that ASAP. But the effect will be that the context menu will be disabled, too. YAM checks for the availibility of openurl.library and enables the button accordingly. It's interesting that launching the browser via openurl.library works while the check for openurl.library signals failure.

A UTIL debug log created by the debug version of YAM will point out what is going wrong there.

[cpm1]

As there are still new users with this issue, how about temporarily replace the github SSL download link in your update database with an Aminet non-SSL download link like http://aminet.net/util/libs/AmiSSL-4.1.lha ?

[Hypexed]

Last night YAM found and downloaded an update for itself from within YAM on OS4.1. So it is working here. If AmiSSL has been updated I must have installed it but I just don't recall doing that exactly. :-)

[AmigaSurfer]

Today YAM210dev-20180215-AmigaOS3 showed me many updates. AmiSSL 4.2, OpenURL 7.18, codeset.library 6.21 and some mui classes. If I press "Update herunterladen" I got the same effect Michael Merkel described in his first post.
| but it does not download. instead it always switches the status from "Baue Verbindung zu Server auf"
| to "Warte auf Antwort vom Server". and this goes endless.
Trying to download with iBrowse 2.4 failed with a SSL error. See attached picture.

I downloaded AmiSSL 4.2 with Windows 7 and installed it on AmigaOS 3.9. But same result, if I try to download any of the other updates.
I updated to YAM210dev-20180307-AmigaOS3, but same result.
I removed ENVARC:AmiSSL/SSL_CLIENT_VERSION tls1, but same result.