From cb7966556ccc54cd47caaaacced815c8b275b885 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 21 Oct 2026 19:36:11 -0400
Subject: [PATCH] security: enforce HTTPS on curl downloads (SonarCloud S6506)
 (#1016)

Add --proto '=https' to curl invocations so redirects cannot downgrade to
plaintext HTTP. Resolves SonarCloud S6506 (shell/docker/githubactions).
---
 packaging/linux/package.sh  | 2 +-
 packaging/server/install.sh | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index 20da2f76..d38dc0bc 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -121,7 +121,7 @@ if has appimage; then
   if [ -z "$TOOL" ]; then
     TOOL="$CARGO_TARGET_DIR/appimagetool-$ARCH.AppImage"
     if [ ! -x "$TOOL" ]; then
-      curl -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
+      curl --proto '=https' -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
       chmod +x "$TOOL"
     fi
   fi
diff --git a/packaging/server/install.sh b/packaging/server/install.sh
index 11c489a3..826c2bb4 100755
--- a/packaging/server/install.sh
+++ b/packaging/server/install.sh
@@ -147,7 +147,7 @@ FILES="$HERE" # where the units and the Caddyfile come from
 from_release() { # download and check the release archive; sets NEW_BIN and FILES
   local version="$VERSION" name dir
   if [ -z "$version" ]; then
-    version="$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p' | head -n 1)" || return 1
+    version="$(curl --proto '=https' -fsSL "https://api.github.com/repos/$REPO/releases/latest" | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p' | head -n 1)" || return 1
     [ -n "$version" ] || return 1
   fi
   name="figcraft-server-$version-linux-$ARCH"
@@ -155,8 +155,8 @@ from_release() { # download and check the release archive; sets NEW_BIN and FILE
   rm -rf "$dir"
   mkdir -p "$dir"
   say "Downloading $name"
-  curl -fsSL -o "$dir/$name.tar.gz" "https://github.com/$REPO/releases/download/v$version/$name.tar.gz" || return 1
-  curl -fsSL -o "$dir/SHA256SUMS.txt" "https://github.com/$REPO/releases/download/v$version/SHA256SUMS.txt" || return 1
+  curl --proto '=https' -fsSL -o "$dir/$name.tar.gz" "https://github.com/$REPO/releases/download/v$version/$name.tar.gz" || return 1
+  curl --proto '=https' -fsSL -o "$dir/SHA256SUMS.txt" "https://github.com/$REPO/releases/download/v$version/SHA256SUMS.txt" || return 1
   (cd "$dir" && grep " $name.tar.gz\$" SHA256SUMS.txt | sha256sum -c --quiet -) || die "the download doesn't match SHA256SUMS.txt"
   tar -C "$dir" -xzf "$dir/$name.tar.gz"
   NEW_BIN="$dir/$name/figcraft-server"