From 8353a29b4f6ada5c7a2c7b3067ca0407e6421278 Mon Sep 17 00:00:00 2001
From: Jabber Developer <jabber.developer@jabber.space>
Date: Wed, 21 Jan 2026 17:10:37 +0100
Subject: [PATCH] fix(ci): remove insecure git clone flag, add ca-certificates

Remove -c http.sslverify=false from all git clones
(enables proper TLS verification, closes MITM risk).
Explicitly install ca-certificates in every CI Docker image.
---
 Dockerfile.arch       | 3 ++-
 Dockerfile.debian     | 5 +++--
 Dockerfile.fedora     | 5 +++--
 Dockerfile.tumbleweed | 3 ++-
 Dockerfile.ubuntu     | 5 +++--
 5 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/Dockerfile.arch b/Dockerfile.arch
index 4c7c29bf..387035cd 100644
--- a/Dockerfile.arch
+++ b/Dockerfile.arch
@@ -13,6 +13,7 @@ RUN pacman -S --needed --noconfirm \
   autoconf-archive \
   automake \
   base-devel \
+  ca-certificates \
   ccache \
   check \
   cmake \
@@ -64,7 +65,7 @@ USER root
 RUN pacman -U --noconfirm libstrophe-git/libstrophe-git-*.pkg.tar.zst
 
 WORKDIR /usr/src
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
 
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh
diff --git a/Dockerfile.debian b/Dockerfile.debian
index 7b515ac5..93c14407 100644
--- a/Dockerfile.debian
+++ b/Dockerfile.debian
@@ -9,6 +9,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
   autoconf \
   autoconf-archive \
   automake \
+  ca-certificates \
   ccache \
   gcc \
   git \
@@ -40,8 +41,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN mkdir -p /usr/src/{stabber,libstrophe,profanity}
 WORKDIR /usr/src
 
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
-RUN git clone --depth 1 -c http.sslverify=false https://github.com/strophe/libstrophe
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://github.com/strophe/libstrophe
 
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh
diff --git a/Dockerfile.fedora b/Dockerfile.fedora
index 6b218d2c..4bfadc4a 100644
--- a/Dockerfile.fedora
+++ b/Dockerfile.fedora
@@ -11,6 +11,7 @@ RUN dnf install -y \
   autoconf-archive \
   automake \
   awk \
+  ca-certificates \
   ccache \
   gcc \
   git \
@@ -50,7 +51,7 @@ ENV TERM=xterm
 RUN mkdir -p /usr/src
 WORKDIR /usr/src
 
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh
 RUN ./configure --prefix=/usr --disable-dependency-tracking
@@ -59,7 +60,7 @@ RUN make install
 
 WORKDIR /usr/src
 RUN mkdir -p /usr/src/libstrophe
-RUN git clone --depth 1 -c http.sslverify=false https://github.com/strophe/libstrophe
+RUN git clone --depth 1 https://github.com/strophe/libstrophe
 WORKDIR /usr/src/libstrophe
 RUN ./bootstrap.sh
 RUN ./configure --prefix=/usr
diff --git a/Dockerfile.tumbleweed b/Dockerfile.tumbleweed
index 76561a10..732e9e26 100644
--- a/Dockerfile.tumbleweed
+++ b/Dockerfile.tumbleweed
@@ -10,6 +10,7 @@ RUN zypper --non-interactive in --no-recommends \
   autoconf \
   autoconf-archive \
   automake \
+  ca-certificates \
   ccache \
   gcc \
   git \
@@ -49,7 +50,7 @@ ENV TERM=xterm
 RUN mkdir -p /usr/src
 WORKDIR /usr/src
 
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh
 RUN ./configure --prefix=/usr --disable-dependency-tracking
diff --git a/Dockerfile.ubuntu b/Dockerfile.ubuntu
index dd95b90e..c4ff309e 100644
--- a/Dockerfile.ubuntu
+++ b/Dockerfile.ubuntu
@@ -8,6 +8,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
   autoconf \
   autoconf-archive \
   automake \
+  ca-certificates \
   ccache \
   gcc \
   git \
@@ -39,8 +40,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN mkdir -p /usr/src/{stabber,libstrophe,profanity}
 WORKDIR /usr/src
 
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
-RUN git clone --depth 1 -c http.sslverify=false https://github.com/strophe/libstrophe
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://github.com/strophe/libstrophe
 
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh