Skip to content

Commit

Permalink
download debootstrap using HTTPS
Browse files Browse the repository at this point in the history
RE: security issue with a dead simple fix: download debootstrap using HTTPS dnschneid#2067 - originally by eighthave

Right now, crouton downloads debootstrap from anonscm.debian.org using an HTTP link. That URL is also accessible using an HTTPS link, e.g.
  • Loading branch information
DennisLfromGA committed Sep 17, 2015
1 parent edbce11 commit 1eeb5c2
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion installer/ubuntu/bootstrap
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@

# Grab the latest release of debootstrap
echo 'Downloading latest debootstrap...' 1>&2
d='http://anonscm.debian.org/gitweb/?p=d-i/debootstrap.git;a=snapshot;h=HEAD;sf=tgz'
d='https://anonscm.debian.org/gitweb/?p=d-i/debootstrap.git;a=snapshot;h=HEAD;sf=tgz'
if ! wget -O- --no-verbose --timeout=60 -t2 "$d" \
| tar -C "$tmp" --strip-components=1 -zx 2>/dev/null; then
echo 'Download from Debian gitweb failed. Trying latest release...' 1>&2
Expand Down

0 comments on commit 1eeb5c2

Please sign in to comment.