Merge pull request #824 from CircleCI-Public/DEVEX-644-security-add-f…

…lag-ssl-reqd-to-curl-command security: added the flag `--ssl-reqd` to the curl command inside the installation script
CircleCI-Public · Jan 16, 2023 · 353a0c2 · 353a0c2
2 parents a272a9f + 2c99912
commit 353a0c2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/install.sh b/install.sh
@@ -51,7 +51,7 @@ esac
 RELEASE_URL="${GITHUB_BASE_URL}/releases/download/v${VERSION}/circleci-cli_${VERSION}_${OS}_amd64.tar.gz"
 
 # Download & unpack the release tarball.
-curl -sL --retry 3 "${RELEASE_URL}" | tar zx --strip 1
+curl --ssl-reqd -sL --retry 3 "${RELEASE_URL}" | tar zx --strip 1
 
 echo "Installing to $DESTDIR"
 install circleci "$DESTDIR"