From 2f9c6b4ca58b374fc5ee9981a28ae7fab5d6750b Mon Sep 17 00:00:00 2001 From: GEAK RDNA Smoke Date: Wed, 26 Aug 2026 06:23:07 -0400 Subject: [PATCH] Use https for dataset download URLs where the host supports TLS Several dataset classes download over plain http. Where the host serves the same content over TLS, switch to https: Food101 data.vision.ee.ethz.ch STL10 ai.stanford.edu SEMEION archive.ics.uci.edu MovingMNIST www.cs.toronto.edu Places365 data.csail.mit.edu KMNIST codh.rois.ac.jp FashionMNIST is not a scheme swap: it pointed at the S3 *website* endpoint (fashion-mnist.s3-website.eu-central-1.amazonaws.com), which serves http only by design. Point it at the REST endpoint for the same bucket instead (fashion-mnist.s3.eu-central-1.amazonaws.com), which supports TLS. Every changed URL was fetched over https and checked against the checksum already pinned in the source. The four small datasets match exactly (FashionMNIST 4/4, KMNIST 4/4, SEMEION, Places365 devkits 2/2); the large archives were confirmed by request. The remaining http URLs are deliberately left alone, with a comment added where the reason is not obvious: yann.lecun.com refuses connections on port 443 (and now 404s) ufldl.stanford.edu certificate is valid only for ai.stanford.edu shuoyang1213.me certificate is for *.github.com Rewriting those would turn a working download into a hostname-verification failure. LFW, PhotoTour and SUN397 are left untouched as well; those hosts no longer resolve or 404 on both schemes, which is tracked separately in #9580, #8711, #9002 and #9348. Co-Authored-By: Claude Opus 5 (1M context) --- torchvision/datasets/food101.py | 2 +- torchvision/datasets/mnist.py | 7 +++++-- torchvision/datasets/moving_mnist.py | 2 +- torchvision/datasets/places365.py | 2 +- torchvision/datasets/semeion.py | 2 +- torchvision/datasets/stl10.py | 2 +- torchvision/datasets/svhn.py | 2 ++ torchvision/datasets/widerface.py | 2 ++ 8 files changed, 14 insertions(+), 7 deletions(-) diff --git a/torchvision/datasets/food101.py b/torchvision/datasets/food101.py index fee23680b05..e0802cc387d 100644 --- a/torchvision/datasets/food101.py +++ b/torchvision/datasets/food101.py @@ -32,7 +32,7 @@ class Food101(VisionDataset): ``torchvision.io.decode_image`` for decoding image data into tensors directly. """ - _URL = "http://data.vision.ee.ethz.ch/cvl/food-101.tar.gz" + _URL = "https://data.vision.ee.ethz.ch/cvl/food-101.tar.gz" _MD5 = "85eeb15f3717b99a5da872d97d918f87" def __init__( diff --git a/torchvision/datasets/mnist.py b/torchvision/datasets/mnist.py index cfa4711834c..6636d827145 100644 --- a/torchvision/datasets/mnist.py +++ b/torchvision/datasets/mnist.py @@ -36,6 +36,9 @@ class MNIST(VisionDataset): mirrors = [ "https://ossci-datasets.s3.amazonaws.com/mnist/", + # yann.lecun.com has no TLS listener (connections to port 443 are refused), so this + # fallback mirror cannot be moved to https. It currently 404s for these files anyway; + # the checksummed https mirror above is the working source. "http://yann.lecun.com/exdb/mnist/", ] @@ -218,7 +221,7 @@ class FashionMNIST(MNIST): downloaded again. """ - mirrors = ["http://fashion-mnist.s3-website.eu-central-1.amazonaws.com/"] + mirrors = ["https://fashion-mnist.s3.eu-central-1.amazonaws.com/"] resources = [ ("train-images-idx3-ubyte.gz", "8d4fb7e6c68d591d4c3dfef9ec88bf0d"), @@ -246,7 +249,7 @@ class KMNIST(MNIST): downloaded again. """ - mirrors = ["http://codh.rois.ac.jp/kmnist/dataset/kmnist/"] + mirrors = ["https://codh.rois.ac.jp/kmnist/dataset/kmnist/"] resources = [ ("train-images-idx3-ubyte.gz", "bdb82020997e1d708af4cf47b453dcf7"), diff --git a/torchvision/datasets/moving_mnist.py b/torchvision/datasets/moving_mnist.py index 4466d82291b..ba102e4b1bd 100644 --- a/torchvision/datasets/moving_mnist.py +++ b/torchvision/datasets/moving_mnist.py @@ -25,7 +25,7 @@ class MovingMNIST(VisionDataset): and returns a transformed version. E.g, ``transforms.RandomCrop`` """ - _URL = "http://www.cs.toronto.edu/~nitish/unsupervised_video/mnist_test_seq.npy" + _URL = "https://www.cs.toronto.edu/~nitish/unsupervised_video/mnist_test_seq.npy" def __init__( self, diff --git a/torchvision/datasets/places365.py b/torchvision/datasets/places365.py index 51b845de723..297920d4d69 100644 --- a/torchvision/datasets/places365.py +++ b/torchvision/datasets/places365.py @@ -38,7 +38,7 @@ class Places365(VisionDataset): """ _SPLITS = ("train-standard", "train-challenge", "val", "test") - _BASE_URL = "http://data.csail.mit.edu/places/places365/" + _BASE_URL = "https://data.csail.mit.edu/places/places365/" # {variant: (archive, md5)} _DEVKIT_META = { "standard": ("filelist_places365-standard.tar", "35a0585fee1fa656440f3ab298f8479c"), diff --git a/torchvision/datasets/semeion.py b/torchvision/datasets/semeion.py index cd8d139cb21..d803ba28829 100644 --- a/torchvision/datasets/semeion.py +++ b/torchvision/datasets/semeion.py @@ -25,7 +25,7 @@ class SEMEION(VisionDataset): """ - url = "http://archive.ics.uci.edu/ml/machine-learning-databases/semeion/semeion.data" + url = "https://archive.ics.uci.edu/ml/machine-learning-databases/semeion/semeion.data" filename = "semeion.data" md5_checksum = "cb545d371d2ce14ec121470795a77432" diff --git a/torchvision/datasets/stl10.py b/torchvision/datasets/stl10.py index 6d7212a1b55..781f4f903ca 100644 --- a/torchvision/datasets/stl10.py +++ b/torchvision/datasets/stl10.py @@ -30,7 +30,7 @@ class STL10(VisionDataset): """ base_folder = "stl10_binary" - url = "http://ai.stanford.edu/~acoates/stl10/stl10_binary.tar.gz" + url = "https://ai.stanford.edu/~acoates/stl10/stl10_binary.tar.gz" filename = "stl10_binary.tar.gz" tgz_md5 = "91f7769df0f17e558f3565bffb0c7dfb" class_names_file = "class_names.txt" diff --git a/torchvision/datasets/svhn.py b/torchvision/datasets/svhn.py index b59f78ec050..c0f9241ac38 100644 --- a/torchvision/datasets/svhn.py +++ b/torchvision/datasets/svhn.py @@ -33,6 +33,8 @@ class SVHN(VisionDataset): """ + # ufldl.stanford.edu serves a certificate valid only for ai.stanford.edu, so https + # fails hostname verification. Contents are checksummed below. split_list = { "train": [ "http://ufldl.stanford.edu/housenumbers/train_32x32.mat", diff --git a/torchvision/datasets/widerface.py b/torchvision/datasets/widerface.py index 31ab28ebdba..e07ee5e11d6 100644 --- a/torchvision/datasets/widerface.py +++ b/torchvision/datasets/widerface.py @@ -49,6 +49,8 @@ class WIDERFace(VisionDataset): ("1GUCogbp16PMGa39thoMMeWxp7Rp5oM8Q", "dfa7d7e790efa35df3788964cf0bbaea", "WIDER_val.zip"), ("1HIfDbVEWKmsYKJZm4lchTBDLW5N7dY5T", "e5d8f4248ed24c334bbd12f49c29dd40", "WIDER_test.zip"), ] + # shuoyang1213.me serves a certificate for *.github.com, so https fails hostname + # verification. Contents are checksummed below. ANNOTATIONS_FILE = ( "http://shuoyang1213.me/WIDERFACE/support/bbx_annotation/wider_face_split.zip", "0e3767bcf0e326556d407bf5bff5d27c",