#893162 ITP: libhsts -- library for checking HSTS preload list

Package:
wnpp
Source:
wnpp
Submitter:
Daniel Kahn Gillmor
Date:
2025-11-29 16:29:49 UTC
Severity:
wishlist
Blocked By:
Bug Title
893159

  3

 src:chromium-browser: Please ship an Architecture: all hstspreload package

wishlist stable testing unstable over 7 years ago

#893162#5
Date:
2018-03-16 23:31:05 UTC
From:
To:
* Package name    : libhsts
  Version         : 0.0.1
  Upstream Author : Tim Rühsen <tim.ruehsen@gmx.de>
* URL             : https://www.gitlab.com/rockdaboot/libhsts
* License         : BSD
  Programming Lang: C
  Description     : library for checking HSTS preload list

The HSTS preload list offers a way for http clients to automatically
opt into encrypted connections.  libhsts offers a way for any http
client to easily access information about the preload list.

Note that the preload list itself should be shipped separately, since
it is likely to be updated more frequently than libhsts itself (see
https://bugs.debian.org/893159).

AIUI, future versions of wget will want to use something like libhsts
to improve communications security for the user.
#893162#12
Date:
2021-09-01 04:52:46 UTC
From:
To:
Daniel Kahn Gillmor wrote:

Note that (AFAIK):

  1. wget2 1.99 (in Debian 11) uses internal code to generate a persistent ~/.wget-hsts.
     This does not require libhsts or any preload file (#893159).
     It means if you do

         wget2 http://google.com
         wget2 http://google.com

     The second call will remember HSTS learnt from the first one.
     This is better than nothing.

  2. libhsts IS the code from wget2.
     It was spun out into a separate library so wget1 could also use it.

  3. wget2 2.00 (releasing this week) needs libhsts;
     the functionality is no longer bundled as it was in 1.99.

     Without libhsts, wget2 2.00 can be built and packaged, but
     ~/.wget-hsts will be ignored (i.e. A REGRESSION!)

On that basis, I don't think #893159 should block #893162, since
~/.wget-hsts is useful even without a chromium preload file.
#893162#17
Date:
2021-09-01 06:27:07 UTC
From:
To:
Trent W. Buck wrote:

Sorry, apparently I was wrong.

    16:24 <rockdaboot[m]> HSTS Handling is done internally. Libhsts only is for preloading HSTS rules (normally taken from Chromium)