Carthage: Can carthage support HTTP besides HTTPS?

[wqzhang123]

My organization uses Artifactory with HTTP, I can't use carthage to distribute pre-compiled frameworks on internal Artifactory. Can carthage make an option like "--use-http" for update?

[mdiep]

We could. We've decided not to because of the potential for security issues.

While it's safe to use http internally, Carthage can't know whether you're hitting an intranet server. So we've required https to safeguard other users.

The correct thing to do here is to use https.

[wqzhang123]

I totally agree https is the correct way, but let carthage's user have an alternative. For example, the default is https, but user must pass the "--use-http" option to the update command, which means the user knows what he is doing, using http instead of https.

So for me right now, until my organization enables Artifactory to https, I can't use carthage to distribute pre-compiled frameworks. Anyway, maybe most organization use https, only mine is http, but I wonder if other people have requested http as an option before.

[jacobjiangwei]

yes, why not let user take his own risks?

[hlineholm]

I totally agree with @wqzhang123 and I have the exact same problem. I've created a #2706 as a proposal for a solution to this.