{"action":"created","issue":{"url":"https://api.github.com/repos/travis-ci/dpl/issues/382","labels_url":"https://api.github.com/repos/travis-ci/dpl/issues/382/labels{/name}","comments_url":"https://api.github.com/repos/travis-ci/dpl/issues/382/comments","events_url":"https://api.github.com/repos/travis-ci/dpl/issues/382/events","html_url":"https://github.com/travis-ci/dpl/issues/382","id":123554291,"number":382,"title":"Use HTTPS/SSL to download the Cloud Foundry CLI","user":{"login":"adelevie","id":86790,"avatar_url":"https://avatars.githubusercontent.com/u/86790?v=3","gravatar_id":"","url":"https://api.github.com/users/adelevie","html_url":"https://github.com/adelevie","followers_url":"https://api.github.com/users/adelevie/followers","following_url":"https://api.github.com/users/adelevie/following{/other_user}","gists_url":"https://api.github.com/users/adelevie/gists{/gist_id}","starred_url":"https://api.github.com/users/adelevie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adelevie/subscriptions","organizations_url":"https://api.github.com/users/adelevie/orgs","repos_url":"https://api.github.com/users/adelevie/repos","events_url":"https://api.github.com/users/adelevie/events{/privacy}","received_events_url":"https://api.github.com/users/adelevie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-22T20:54:00Z","updated_at":"2015-12-22T21:04:25Z","closed_at":null,"body":"I noticed this line in https://github.com/travis-ci/dpl/blob/master/lib/dpl/provider/cloud_foundry.rb:\r\n\r\n```ruby\r\ncontext.shell 'wget http://go-cli.s3-website-us-east-1.amazonaws.com/releases/latest/cf-linux-amd64.tgz -qO cf-linux-amd64.tgz && tar -zxvf cf-linux-amd64.tgz && rm cf-linux-amd64.tgz'\r\n```\r\n\r\nTools like this should rely on secure SSL downloads. Otherwise this is a significant security risk for deployments.\r\n\r\nI tried changing the URL to use https and it did not work. So perhaps there is some other link to the prebuilt binary?"},"comment":{"url":"https://api.github.com/repos/travis-ci/dpl/issues/comments/166729099","html_url":"https://github.com/travis-ci/dpl/issues/382#issuecomment-166729099","issue_url":"https://api.github.com/repos/travis-ci/dpl/issues/382","id":166729099,"user":{"login":"konklone","id":4592,"avatar_url":"https://avatars.githubusercontent.com/u/4592?v=3","gravatar_id":"","url":"https://api.github.com/users/konklone","html_url":"https://github.com/konklone","followers_url":"https://api.github.com/users/konklone/followers","following_url":"https://api.github.com/users/konklone/following{/other_user}","gists_url":"https://api.github.com/users/konklone/gists{/gist_id}","starred_url":"https://api.github.com/users/konklone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/konklone/subscriptions","organizations_url":"https://api.github.com/users/konklone/orgs","repos_url":"https://api.github.com/users/konklone/repos","events_url":"https://api.github.com/users/konklone/events{/privacy}","received_events_url":"https://api.github.com/users/konklone/received_events","type":"User","site_admin":false},"created_at":"2015-12-22T21:04:25Z","updated_at":"2015-12-22T21:04:25Z","body":"It's actually worse, because it redirects out to another plain HTTP URL before coming _back_ to a third HTTP URL:\r\n\r\n```\r\n$ curl --head http://go-cli.s3-website-us-east-1.amazonaws.com/releases/latest/cf-linux-amd64.tgz\r\nHTTP/1.1 301 Moved Permanently\r\nLocation: http://cli.run.pivotal.io/stable?release=linux64-binary&source=s3-go-cli\r\n\r\n$ curl --head \"http://cli.run.pivotal.io/stable?release=linux64-binary&source=s3-go-cli\"\r\nHTTP/1.1 302 Found\r\nLocation: http://go-cli.s3-website-us-east-1.amazonaws.com/releases/v6.14.0/cf-cli_6.14.0_linux_x86-64.tgz\r\n\r\n$ curl --head \"http://go-cli.s3-website-us-east-1.amazonaws.com/releases/v6.14.0/cf-cli_6.14.0_linux_x86-64.tgz\"\r\nHTTP/1.1 200 OK\r\nContent-Type: application/gzip; charset=binary\r\nContent-Length: 5523435\r\n```\r\n\r\nYou can't just naively rewrite the original URL from the \"S3 Website\" form to the \"S3 Bucket\" form, add HTTPS, either -- it gives you a 0-byte file:\r\n\r\n```\r\n$ curl --head https://s3.amazonaws.com/go-cli/releases/latest/cf-linux-amd64.tgz\r\nHTTP/1.1 200 OK\r\nAccept-Ranges: bytes\r\nContent-Type: binary/octet-stream\r\nContent-Length: 0\r\n```\r\n\r\nSo this download pipeline needs to be reconfigured. I believe this should be treated as an urgent security issue by the maintainers here."}}