From c96d9b910e7b5fcc84a95ffaa3a6ba77375bc8b8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 22 Aug 2026 11:42:58 +0000
Subject: [PATCH] Enforce HTTPS-only redirects in download-latest.sh

SonarCloud flagged both curl/wget calls in the new release-download
script (rule shell:S6506): a redirect could silently downgrade the
transfer to plain HTTP, allowing a MITM to serve a tampered release.

- The GitHub API request now runs through a shared curl invocation
  with --proto '=https' --proto-redir '=https', which rejects both an
  insecure initial URL and an insecure redirect target.
- The release-archive download switches from wget to the same curl
  invocation, since wget (tested against a local redirecting server)
  has no equivalent way to reject an HTTP redirect target for a
  non-recursive download; --https-only only restricts recursive link
  following, not redirects. This also drops wget from the script's
  required-commands check.
---
 packaging/download-latest.sh | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/packaging/download-latest.sh b/packaging/download-latest.sh
index 8c890bb..d826dfa 100755
--- a/packaging/download-latest.sh
+++ b/packaging/download-latest.sh
@@ -8,6 +8,10 @@
 set -euo pipefail
 
 readonly REPOSITORY='larslaskowski/pimonitor'
+# Restrict both the initial request and any redirect to HTTPS, so a
+# compromised or misconfigured server can't downgrade the download to plain
+# HTTP.
+readonly CURL=(curl -fsSL --proto '=https' --proto-redir '=https')
 
 if [[ -z "${ARCH:-}" ]]; then
   case "$(uname -m)" in
@@ -35,14 +39,14 @@ case "${ARCH:-}" in
     ;;
 esac
 
-for command in curl wget tar; do
+for command in curl tar; do
   if ! command -v "$command" >/dev/null 2>&1; then
     printf 'Required command not found: %s\n' "$command" >&2
     exit 1
   fi
 done
 
-version=$(curl -fsSL "https://api.github.com/repos/${REPOSITORY}/releases/latest" \
+version=$("${CURL[@]}" "https://api.github.com/repos/${REPOSITORY}/releases/latest" \
   | awk -F '"' '/"tag_name"/ { print $4; exit }')
 
 if [[ -z "$version" ]]; then
@@ -61,7 +65,7 @@ if [[ -e "$directory" ]]; then
 fi
 
 printf 'Downloading PiMonitor %s for %s ...\n' "$version" "$ARCH"
-wget --no-clobber "$url"
+"${CURL[@]}" -o "$archive" "$url"
 
 printf 'Extracting %s ...\n' "$archive"
 tar xzf "$archive"