[ptxdist] [PATCH] strongswan: secure download url (http -> https)

[ptxdist] [PATCH] strongswan: secure download url (http -> https)

[Bruno Thomsen]

Downloading the package source from an unsecure locations and using an insecure hash (md5)
would allow a malicious proxy to inject vulnerabilities.
The build system would be unable to detect it.

Signed-off-by: Bruno Thomsen <bth@kamstrup.com>
---
 rules/strongswan.make | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/strongswan.make b/rules/strongswan.make
index 9a9dd40..033deeb 100644
--- a/rules/strongswan.make
+++ b/rules/strongswan.make
@@ -21,7 +21,7 @@ STRONGSWAN_VERSION	:= 5.3.2
 STRONGSWAN_MD5		:= fab014be1477ef4ebf9a765e10f8802c
 STRONGSWAN		:= strongswan-$(STRONGSWAN_VERSION)
 STRONGSWAN_SUFFIX	:= tar.bz2
-STRONGSWAN_URL		:= http://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
+STRONGSWAN_URL		:= https://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
 STRONGSWAN_SOURCE	:= $(SRCDIR)/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
 STRONGSWAN_DIR		:= $(BUILDDIR)/$(STRONGSWAN)
 STRONGSWAN_LICENSE	:= GPL
-- 
2.1.4


-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH] strongswan: secure download url (http -> https)

[Michael Olbrich]

On Tue, Jul 07, 2015 at 03:29:41PM +0200, Bruno Thomsen wrote:
> Downloading the package source from an unsecure locations and using an insecure hash (md5)
> would allow a malicious proxy to inject vulnerabilities.
> The build system would be unable to detect it.
> 

Thanks, applied.

Michael

> Signed-off-by: Bruno Thomsen <bth@kamstrup.com>
> ---
>  rules/strongswan.make | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/rules/strongswan.make b/rules/strongswan.make
> index 9a9dd40..033deeb 100644
> --- a/rules/strongswan.make
> +++ b/rules/strongswan.make
> @@ -21,7 +21,7 @@ STRONGSWAN_VERSION	:= 5.3.2
>  STRONGSWAN_MD5		:= fab014be1477ef4ebf9a765e10f8802c
>  STRONGSWAN		:= strongswan-$(STRONGSWAN_VERSION)
>  STRONGSWAN_SUFFIX	:= tar.bz2
> -STRONGSWAN_URL		:= http://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
> +STRONGSWAN_URL		:= https://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
>  STRONGSWAN_SOURCE	:= $(SRCDIR)/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
>  STRONGSWAN_DIR		:= $(BUILDDIR)/$(STRONGSWAN)
>  STRONGSWAN_LICENSE	:= GPL
> -- 
> 2.1.4
> 
> 
> -- 
> ptxdist mailing list
> ptxdist@pengutronix.de

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

-- 
ptxdist mailing list
ptxdist@pengutronix.de