sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-16 19:59:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Enforce HTTPS on install script downloads (#7545)

Browse Source 
Every curl invocation in the install script that follows redirects now passes
`--proto` and `--proto-redir` set to https only, so neither the initial request
nor any hop in the redirect chain can drop to plaintext. This matters most for
the macOS .pkg download, whose URL is itself the result of a redirect
resolution, and for the release tarballs that get moved into the install dir as
root.

The protocol set lives in a single `PROTO_HTTPS` variable rather than being
repeated at each call site, and every expansion is quoted — the variable holds
one option value, not a list of flags.

The two call sites without `-L` (the release metadata lookups) are left alone:
they do not follow redirects and their URLs are https literals.

Verified against every URL the script fetches on curl 7.29.0 (CentOS 7),
7.68.0, 7.76.1, 7.88.1 and 8.14.1; both options have existed since curl 7.20.0.
Plaintext http:// is refused on all of them.
This commit is contained in:
Riccardo Manfrin
2026-09-15 14:20:15 +02:00
committed by GitHub
parent e70ec07320
commit 08699a9e29
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
release_files/install.sh
+8 -5
View File
@@ -17,6 +17,9 @@ ARCH="$(uname -m)"
PACKAGE_MANAGER="bin"
INSTALL_DIR=""
SUDO=""
# curl protocol set for --proto / --proto-redir: https and nothing else, so no
# request and no redirect in a chain can fall back to plaintext.
PROTO_HTTPS="=https"
if command -v sudo > /dev/null && [ "$(id -u)" -ne 0 ]; then
@@ -84,9 +87,9 @@ download_release_binary() {
echo "Installing $1 from $DOWNLOAD_URL"
ARCHIVE_PATH="${NB_TMPDIR}/${BINARY_NAME}"
if [ -n "$GITHUB_TOKEN" ]; then
curl -H "Authorization: token ${GITHUB_TOKEN}" -L -o "$ARCHIVE_PATH" "$DOWNLOAD_URL"
curl -H "Authorization: token ${GITHUB_TOKEN}" -L --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" -o "$ARCHIVE_PATH" "$DOWNLOAD_URL"
else
curl -L -o "$ARCHIVE_PATH" "$DOWNLOAD_URL" || curl -L -o "$ARCHIVE_PATH" --dns-servers 8.8.8.8 "$DOWNLOAD_URL"
curl -L --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" -o "$ARCHIVE_PATH" "$DOWNLOAD_URL" || curl -L --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" -o "$ARCHIVE_PATH" --dns-servers 8.8.8.8 "$DOWNLOAD_URL"
fi
@@ -120,7 +123,7 @@ add_apt_repo() {
/usr/share/keyrings/netbird-archive-keyring.gpg \
/usr/share/keyrings/wiretrustee-archive-keyring.gpg
curl -sSL https://pkgs.netbird.io/debian/public.key \
curl -sSL --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" https://pkgs.netbird.io/debian/public.key \
| ${SUDO} gpg --dearmor -o /usr/share/keyrings/netbird-archive-keyring.gpg
# Explicitly set the file permission
@@ -193,9 +196,9 @@ install_pkg() {
*) echo "Unsupported macOS arch: $(uname -m)" >&2; exit 1 ;;
esac
PKG_URL=$(curl -sIL -o /dev/null -w '%{url_effective}' "https://pkgs.netbird.io/macos/${ARCH}")
PKG_URL=$(curl -sIL --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" -o /dev/null -w '%{url_effective}' "https://pkgs.netbird.io/macos/${ARCH}")
echo "Downloading NetBird macOS installer from https://pkgs.netbird.io/macos/${ARCH}"
curl -fsSL -o "${NB_TMPDIR}/netbird.pkg" "${PKG_URL}"
curl -fsSL --proto "$PROTO_HTTPS" --proto-redir "$PROTO_HTTPS" -o "${NB_TMPDIR}/netbird.pkg" "${PKG_URL}"
${SUDO} installer -pkg "${NB_TMPDIR}/netbird.pkg" -target /
}