Repository navigation
Require HTTPS downloads and wheel-only CI dependencies #55
Description
Sonar's current main analysis identifies four curl calls that follow redirects
without restricting their protocols and one policy dependency install that
allows source builds. Current source is a10f94857d687b6368899c66ad3bf746fe2a1bc3.
curl permits HTTP redirects by default, even when the original URL is HTTPS.
The build helpers download executable Box/SPC tools, release CI downloads its
checksum-pinned SPC archive, and the public-asset check follows release URLs.
See the curl protocol documentation.
Constrain initial transfers and redirects to HTTPS and require a binary wheel
for the existing pinned PyYAML policy dependency. Preserve tool versions,
checksums, retries, URLs and release/package behavior. Qualify the ordinary CLI
checks and review the exact new Sonar result. This is build-tool hardening, not
a confirmed customer incident or a claim that an upstream download was attacked.
Findings: AaFA6fWdvBsSKkyuiq-s, AaFA6fWdvBsSKkyuiq-t,
AaFA6fWzvBsSKkyuiq-3, AaFA6fXbvBsSKkyuiq_E, AaFA6fXIvBsSKkyuiq_D.
Related organization-wide Sonar maintenance: durable-workflow/.github#187.
Activity
rmcdaniel commentedon Oct 17, 2026
Delivered source hardening in #56,
merge
88ebad257df20b63f399675a88085cbefb612d1f, identical reviewed tree5ba4b42bdd8c5d1506c7ae9037a9b1500909ae74.passes all eight jobs, including PHP 8.2–8.5 and PHAR smoke/reproducibility.
independently read back as CLOSED/FIXED in analysis
9cbf2794-98c4-48c9-b160-328f6a91355e.passes all four native platforms, including macOS 15 ARM64. Release-only
packaging/signal checks skip in this operation; no new CLI release or public
asset is published.
The earlier YAML and source-assertion failures remain failed. The two fixture
false positives and one accepted minor literal suggestion have scoped reasons;
rules and thresholds remain enabled. All local task resources, raw transports
and the completed clean source branch/worktree are retired.