From dec78db02c90a5060b4562036cff22d871f47059 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 21 Oct 2026 19:36:16 -0400
Subject: [PATCH] security: enforce HTTPS on curl downloads (SonarCloud S6506)
 (#1519)

Add --proto '=https' to curl invocations so redirects cannot downgrade to
plaintext HTTP. Resolves SonarCloud S6506 (shell/docker/githubactions).
---
 packaging/linux/package.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index 2d7b80ee..12ad8e0f 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -148,7 +148,7 @@ if has appimage; then
     TOOL="$CARGO_TARGET_DIR/appimagetool-$APPIMAGETOOL_VERSION-$ARCH.AppImage"
     if [ ! -x "$TOOL" ]; then
       download="$TOOL.download"
-      curl -fsSL -o "$download" \
+      curl --proto '=https' -fsSL -o "$download" \
         "https://github.com/AppImage/appimagetool/releases/download/$APPIMAGETOOL_VERSION/appimagetool-$ARCH.AppImage"
       printf '%s  %s\n' "$APPIMAGETOOL_SHA256" "$download" | sha256sum -c -
       chmod 755 "$download"