From 3ec52a9ff19605593a3f5f7efbe85589913fc845 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 21 Oct 2026 20:11:03 -0400 Subject: [PATCH] security: enforce HTTPS on curl downloads (SonarCloud S6506) (#8369) Add --proto '=https' to curl invocations so redirects cannot downgrade to plaintext HTTP. Resolves SonarCloud S6506 (shell/docker/githubactions). --- .github/workflows/ci.yml | 2 +- Dockerfile | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 238029a860..d2ef8943dd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -361,7 +361,7 @@ jobs: cache-on-failure: true - name: Install trunk run: | - curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \ + curl --proto '=https' -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \ | tar -xz -C "$HOME/.cargo/bin" trunk trunk --version # package.sh runs Trunk's release builds, validates relative URLs, cuts the wasm into diff --git a/Dockerfile b/Dockerfile index 66734f255a..1803d3a2e9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -25,8 +25,8 @@ RUN set -eu; \ asset="trunk-${arch}-unknown-linux-musl.tar.gz"; \ url="https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}"; \ cd /tmp; \ - curl -fsSL --retry 3 -A Photocraft-dev "$url/$asset" -o "$asset"; \ - curl -fsSL --retry 3 -A Photocraft-dev "$url/$asset.sha256" -o "$asset.sha256"; \ + curl --proto '=https' -fsSL --retry 3 -A Photocraft-dev "$url/$asset" -o "$asset"; \ + curl --proto '=https' -fsSL --retry 3 -A Photocraft-dev "$url/$asset.sha256" -o "$asset.sha256"; \ printf '%s %s\n' "$(cat "$asset.sha256")" "$asset" | sha256sum -c -; \ tar -xzf "$asset" -C /usr/local/bin trunk; \ rm "$asset" "$asset.sha256"; \