mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-16 11:49:06 +02:00
Riccardo Manfrin
08699a9e29
Every curl invocation in the install script that follows redirects now passes `--proto` and `--proto-redir` set to https only, so neither the initial request nor any hop in the redirect chain can drop to plaintext. This matters most for the macOS .pkg download, whose URL is itself the result of a redirect resolution, and for the release tarballs that get moved into the install dir as root. The protocol set lives in a single `PROTO_HTTPS` variable rather than being repeated at each call site, and every expansion is quoted — the variable holds one option value, not a list of flags. The two call sites without `-L` (the release metadata lookups) are left alone: they do not follow redirects and their URLs are https literals. Verified against every URL the script fetches on curl 7.29.0 (CentOS 7), 7.68.0, 7.76.1, 7.88.1 and 8.14.1; both options have existed since curl 7.20.0. Plaintext http:// is refused on all of them.