Avoid excessive use of FTP

[ChrysoliteAzalea]

Hello everyone! Today, I've looked at the woof-CE source code, and found that it excessively uses insecure protocols that don't verify the integrity of received data and therefore vulnerable to malicious injections from untrusted networks. I would like to avoid that, because woof-CE deals with very sensitive software code (such as the kernel).

[dimkr]

1. Please roll back changes that have mo security implications, like changes to comments
2. Without a script that checks that every HTTP->HTTPS URL both supports HTTPS and has a valid (= not self-signed) certificate, this PR is super dangerous

[dimkr]

Word of caution: at some point I tried to remove the --no-check-certificate in

woof-CE/woof-code/support/download_file.sh

Line 32 in 38e2eaf

wget -P ${DOWNLOAD_DIR} --no-check-certificate "${URL}"

, but it looks like in some cases, woof-CE uses HTTPS URLs with broken certificates.

[ChrysoliteAzalea]

OK, I've got that. I think I'll leave all http:// links intact for some time, and only change the ftp:// and git:// links (there is a **git:// link that points to GitHub, that supports HTTPS), because FTP is a really old and insecure protocol.

[dimkr]

AFAIK git:// is plaintext too

[ChrysoliteAzalea]

OK, all git:// and ftp:// were switched to https://. Also, I've switched some http:// to https://, and removed all mirrors I was not sure about.

[ChrysoliteAzalea]

Also, as far as I checked, archive.ubuntu.com doesn't support HTTPS, so in that case, HTTP is the only option.

I'm also researching the possibility of building a Puppy distribution from user's local sources, so it could be built without active Internet connection.

[dimkr]

I'm also researching the possibility of building a Puppy distribution from user's local sources, so it could be built without active Internet connection.

If you use file:// URLs, it will mostly work. There will be some exceptions (like petbuilds, the ad blocker's pinstall.sh, etc').