bootstrap, gnulib-tool: use https instead of insecure rsync

The rsync command does not do any authentication and thus allows
man-in-the-middle attacks.  Better use wget over https, although
this is slower.

* build-aux/bootstrap (download_po_files, po_download_command_format):
Don't try using rsync; always use wget over https to fetch PO files.
* gnulib-tool (func_import): Likewise.
* pygnulib/GLImport.py (GLImport.execute): Likewise.

1 files changed, 3 insertions, 10 deletions

diff --git a/pygnulib/GLImport.py b/pygnulib/GLImport.py
index 3b4729ee7c..19ade5e8d1 100644
--- a/pygnulib/GLImport.py
+++ b/pygnulib/GLImport.py
@@ -1200,19 +1200,12 @@ AC_DEFUN([%s_FILE_LIST], [\n''' % macro_prefix
 
             # Fetch PO files.
             TP_URL = 'https://translationproject.org/latest/'
-            TP_RSYNC_URI = 'translationproject.org::tp/latest/'
             if not self.config['dryrun']:
                 print('Fetching gnulib PO files from %s' % TP_URL)
                 os.chdir(joinpath(destdir, pobase))
-                cmd = 'type rsync 2>/dev/null | grep / > /dev/null'
-                result = sp.call(cmd, shell=True)
-                if result == 0:  # use rsync
-                    args = ['rsync', '--include', '*.po', '--exclude', '*', '-Lrtz', '%sgnulib/' % TP_RSYNC_URI, '.']
-                    result = sp.call(args, shell=True)
-                if result != 0:  # use wget
-                    args = ['wget', '--no-verbose', '--mirror', '--level=1', '-nd', '-A.po', '-P', '.',
-                            '%sgnulib/' % TP_URL]
-                    sp.call(args, shell=True)
+                args = ['wget', '--no-verbose', '--mirror', '--level=1', '-nd', '-A.po', '-P', '.',
+                        '%sgnulib/' % TP_URL]
+                sp.call(args, shell=True)
             else:  # if self.config['dryrun']
                 print('Fetch gnulib PO files from %s' % TP_URL)