Arduino: Serve package index over HTTPS

[VictorTagayun]

Why is the board manager http://arduino.esp8266.com/stable/package_esp8266com_index.json not in https like ESP32 https://dl.espressif.com/dl/package_esp32_index.json ?
I cannot load ESP8266 in our work office, thus I need to hotspot my mobile to connect and download everytime the json file.

[igrr]

Switching to HTTPS for the package download is something we will be looking into before the next release, thanks for bringing this up.

[VictorTagayun]

Short term I am using github https://github.com/esp8266/Arduino/releases/download/2.4.2/package_esp8266com_index.json
Thanks for considering this.

[devyte]

Release 2.5.0-beta1 is out, in case you want to use that json instead.

[VictorTagayun]

Thanks for the offer.
Ill wait for the final release.

[devyte]

I should rephrase: ... in case you want to try it out and provide feedback :)

[devyte]

@igrr has there been any progress?

[igrr]

@devyte Some progress — I have created a repo, but don't have a domain name at esp8266.com yet. Will ping the owner (Espressif) again.

[devyte]

@igrr due date for 2.5.0 was yesterday. I assume this still needs more time and should be pushed back?

[igrr]

Have set up https://arduino-test.esp8266.com/ which is generated from https://github.com/esp8266/esp8266.github.io. HTTPS seems to work. Next step is to upload existing package .json to that repo, and test that Arduino IDE can use that as a package manager URL.

[gvarisco]

Hi @igrr! I can confirm that the Arduino IDE correctly works with HTTPS endpoints. Could you please enable HTTPS on arduino.esp8266.com as well? Is there anything we can help with, re: testing?

[igrr]

@gvarisco Sure, can you try installing the package using this boards manager package URL?

https://arduino-test.esp8266.com/stable/package_esp8266com_index.json

(instead of the usual http://arduino.esp8266.com/stable/package_esp8266com_index.json)

If that works, I'll ask the DNS record owner to switch arduino.esp8266.com from the current A record to a CNAME record pointing to the github pages site.

[igrr]

One more thing to test, is that the http->https redirection works, i.e. if the boards manager package URL is set as

http://arduino-test.esp8266.com/stable/package_esp8266com_index.json

then Arduino will install the package successfully, after redirection to https.

[gvarisco]

Hi @igrr! I can confirm that installing the package using the board manager's package URL you provided (the https one) works just fine on Arduino IDE. I can also confirm that the http->https redirection (via 301) WORKS as expected, and both the package's index as well the package itself get download without any problems. You should be good to switch the main host over it.

[igrr]

Okay, done. The package is now available from arduino.esp8266.com both via http and https. I have not enabled automatic redirection from http to https just yet.

Next step is to update release scripts in this repo to automatically upload the new package version for every release.

[gvarisco]

@igrr thanks for working on #5992. I've noticed there's no 301 redirect on http://arduino.esp8266.com/ (http->https) or even better HSTS. Do you have any plan for it?

[igrr]

@gvarisco Unfortunately, old versions of Arduino IDE can not verify the certificate of https://arduino.esp8266.com, so we can not enable the HTTP -> HTTPS redirect.