# Supermarket cookbook URL not using TLS

**URL:** <https://discourse.chef.io/t/supermarket-cookbook-url-not-using-tls/6384>\
**Category:** Chef Infra (archive)\
**Created:** [March 2, 2015, 11:44pm UTC](https://discourse.chef.io/t/supermarket-cookbook-url-not-using-tls/6384 "2015-03-02T23:44:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel\_Klopp](https://avatars.discourse-cdn.com/v4/letter/d/e19b73/32.png) [@Daniel\_Klopp](https://discourse.chef.io/u/Daniel_Klopp)\
**Post date:** [March 2, 2015, 11:44pm UTC](https://discourse.chef.io/t/supermarket-cookbook-url-not-using-tls/6384/1 "2015-03-02T23:44:32Z")

</div>

I’ve used the Chef Supermarket cookbook from [https://github.com/opscode-cookbooks/supermarket](https://github.com/opscode-cookbooks/supermarket) to deploy a private Supermarket. By default Supermarket seems to store cookbook references with a standard HTTP URI, but TLS is already configured on the private Supermarket with a proper cert. For example, the URI: [https://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/](https://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/) returns

{“license”:“All Rights Reserved”,“tarball\_file\_size”:349297,“version”:“0.1.3”,“average\_rating”:null,“cookbook”:“[http://UNDISCLOSED/api/v1/cookbooks/my-keepalived",“file”:“http://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/download”,“dependencies”:{“python”:"](http://UNDISCLOSED/api/v1/cookbooks/my-keepalived%22,%22file%22:%22http://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/download%22,%22dependencies%22:%7B%22python%22:%22)\>= 0.0.0”,“ark”:"\>= 0.0.0",“shared\_ip”:"\>= 0.0.0",“keepalived”:"\>= 0.0.0"}}

It gives a reference to HTTP instead of HTTPS from within an HTTPS context. This causes security errors with Berk’s libraries.

Is there a simple configuration option I am missing to store the cookbooks under an HTTPS URI?

-Dan

This communication is Confidential Information. By using this message and attachments you implicitly consent to terms and conditions set forth at [http://www.taos.com/email\_disclaimer](http://www.taos.com/email_disclaimer). If you do not consent or received this message in error, please destroy it.

---

<div class="post-metadata">

**Author:** ![ccrebolder](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/ccrebolder/32/144_2.png) [@ccrebolder](https://discourse.chef.io/u/ccrebolder)\
**Post date:** [March 3, 2015, 8:16pm UTC](https://discourse.chef.io/t/supermarket-cookbook-url-not-using-tls/6384/2 "2015-03-03T20:16:12Z")

</div>

I noticed this the other day and haven’t had time to file an issue, but just fired this off:  
[https://github.com/chef/supermarket/issues/994](https://github.com/chef/supermarket/issues/994)

In the meantime I’m using a copy of the nginx template with the two lines corrected.

Chris Crebolder | Network Services Specialist | University of Toronto Libraries | Information Technology Services

* * *

From: Daniel Klopp [dklopp@taos.com]  
Sent: Monday, March 02, 2015 6:44 PM  
To: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
Subject: [chef] Supermarket cookbook URL not using TLS

I’ve used the Chef Supermarket cookbook from [https://github.com/opscode-cookbooks/supermarket](https://github.com/opscode-cookbooks/supermarket) to deploy a private Supermarket. By default Supermarket seems to store cookbook references with a standard HTTP URI, but TLS is already configured on the private Supermarket with a proper cert. For example, the URI: [https://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/](https://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/) returns

{“license”:“All Rights Reserved”,“tarball\_file\_size”:349297,“version”:“0.1.3”,“average\_rating”:null,“cookbook”:“[http://UNDISCLOSED/api/v1/cookbooks/my-keepalived",“file”:“http://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/download”,“dependencies”:{“python”:"](http://UNDISCLOSED/api/v1/cookbooks/my-keepalived%22,%22file%22:%22http://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/download%22,%22dependencies%22:%7B%22python%22:%22)\>= 0.0.0”,“ark”:"\>= 0.0.0",“shared\_ip”:"\>= 0.0.0",“keepalived”:"\>= 0.0.0"}}

It gives a reference to HTTP instead of HTTPS from within an HTTPS context. This causes security errors with Berk’s libraries.

Is there a simple configuration option I am missing to store the cookbooks under an HTTPS URI?

-Dan

This communication is Confidential Information. By using this message and attachments you implicitly consent to terms and conditions set forth at [http://www.taos.com/email\_disclaimer](http://www.taos.com/email_disclaimer). If you do not consent or received this message in error, please destroy it.

---

<div class="post-metadata">

**Author:** ![smith](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/smith/32/92_2.png) [@smith](https://discourse.chef.io/u/smith)\
**Post date:** [March 4, 2015, 8:07pm UTC](https://discourse.chef.io/t/supermarket-cookbook-url-not-using-tls/6384/3 "2015-03-04T20:07:46Z")

</div>

I think those URLs are using the Rails URL helpers in

> **[GitHub - chef/supermarket: Chef's community platform](https://github.com/chef/supermarket)**
>
> Chef's community platform. Contribute to chef/supermarket development by creating an account on GitHub.

/blob/master/app/views/api/v1/cookbook\_versions/\_cookbook\_version.json.jbuilder

What does it do if ENV['PROTOCOL'] is set to https?

Also, this is the Chef mailing list and you might get a better response on  
the Supermarket Google group:  
[https://groups.google.com/forum/#!forum/chef-supermarket](https://groups.google.com/forum/#!forum/chef-supermarket)

On Mon, Mar 2, 2015 at 5:44 PM, Daniel Klopp [dklopp@taos.com](mailto:dklopp@taos.com) wrote:

> I've used the Chef Supermarket cookbook from  
> [GitHub - chef-boneyard/supermarket: DEPRECATED: Cookbook For Deploying Supermarket](https://github.com/opscode-cookbooks/supermarket) to deploy a private  
> Supermarket. By default Supermarket seems to store cookbook references  
> with a standard HTTP URI, but TLS is already configured on the private  
> Supermarket with a proper cert. For example, the URI:  
> [https://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/](https://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/) returns
> 
> {"license":"All Rights Reserved","tarball\_file\_size":349297,"version":"0.1.3","average\_rating":null,"cookbook":"[http://UNDISCLOSED/api/v1/cookbooks/my-keepalived","file":"http://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/download","dependencies":{"python":"](http://UNDISCLOSED/api/v1/cookbooks/my-keepalived%22,%22file%22:%22http://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/download%22,%22dependencies%22:%7B%22python%22:%22)\>= 0.0.0","ark":"\>= 0.0.0","shared\_ip":"\>= 0.0.0","keepalived":"\>= 0.0.0"}}
> 
> It gives a reference to HTTP instead of HTTPS from within an HTTPS  
> context. This causes security errors with Berk's libraries.
> 
> Is there a simple configuration option I am missing to store the cookbooks  
> under an HTTPS URI?
> 
> -Dan
> 
> This communication is Confidential Information. By using this message and  
> attachments you implicitly consent to terms and conditions set forth at  
> [Taos is now IBM Platform Engineering Services | IBM](http://www.taos.com/email_disclaimer). If you do not consent or received  
> this message in error, please destroy it.

--  
Nathan L Smith  
[smith@chef.io](mailto:smith@chef.io)  
(319) 339-0466

---

<div class="post-metadata">

**Author:** ![Daniel\_Klopp](https://avatars.discourse-cdn.com/v4/letter/d/e19b73/32.png) [@Daniel\_Klopp](https://discourse.chef.io/u/Daniel_Klopp)\
**Post date:** [March 5, 2015, 6:26pm UTC](https://discourse.chef.io/t/supermarket-cookbook-url-not-using-tls/6384/4 "2015-03-05T18:26:18Z")

</div>

the env PROTOCOL is set to https. I’ll contact that list, thank you.

-Dan

* * *

From: Nathan L Smith [smith@chef.io]  
Sent: Wednesday, March 04, 2015 12:07 PM  
To: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
Subject: [chef] Re: Supermarket cookbook URL not using TLS

I think those URLs are using the Rails URL helpers in [https://github.com/chef/supermarket/blob/master/app/views/api/v1/cookbook\_versions/\_cookbook\_version.json.jbuilder](https://github.com/chef/supermarket/blob/master/app/views/api/v1/cookbook_versions/_cookbook_version.json.jbuilder)

What does it do if ENV[‘PROTOCOL’] is set to https?

Also, this is the Chef mailing list and you might get a better response on the Supermarket Google group: [https://groups.google.com/forum/#!forum/chef-supermarket](https://groups.google.com/forum/#!forum/chef-supermarket)

On Mon, Mar 2, 2015 at 5:44 PM, Daniel Klopp \<[dklopp@taos.com](mailto:dklopp@taos.com)[mailto:dklopp@taos.com](mailto:dklopp@taos.com)\> wrote:  
I’ve used the Chef Supermarket cookbook from [https://github.com/opscode-cookbooks/supermarket](https://github.com/opscode-cookbooks/supermarket) to deploy a private Supermarket. By default Supermarket seems to store cookbook references with a standard HTTP URI, but TLS is already configured on the private Supermarket with a proper cert. For example, the URI: [https://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/](https://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/) returns

{“license”:“All Rights Reserved”,“tarball\_file\_size”:349297,“version”:“0.1.3”,“average\_rating”:null,“cookbook”:“[http://UNDISCLOSED/api/v1/cookbooks/my-keepalived",“file”:“http://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/download”,“dependencies”:{“python”:"](http://UNDISCLOSED/api/v1/cookbooks/my-keepalived%22,%22file%22:%22http://UNDISCLOSED/api/v1/cookbooks/my-keepalived/versions/0.1.3/download%22,%22dependencies%22:%7B%22python%22:%22)\>= 0.0.0”,“ark”:"\>= 0.0.0",“shared\_ip”:"\>= 0.0.0",“keepalived”:"\>= 0.0.0"}}

It gives a reference to HTTP instead of HTTPS from within an HTTPS context. This causes security errors with Berk’s libraries.

Is there a simple configuration option I am missing to store the cookbooks under an HTTPS URI?

-Dan

This communication is Confidential Information. By using this message and attachments you implicitly consent to terms and conditions set forth at [http://www.taos.com/email\_disclaimer](http://www.taos.com/email_disclaimer). If you do not consent or received this message in error, please destroy it.

–  
Nathan L Smith  
[smith@chef.io](mailto:smith@chef.io)[mailto:smith@chef.io](mailto:smith@chef.io)  
(319) 339-0466