devs/cproof
1
2
Fork 1
Code Issues 43 Pull Requests 6 Actions Packages Projects 1 Releases Wiki Activity

ci security: Remove -c http.sslverify=false from git clone commands #74

New Issue
Closed
opened 2026-01-21 16:05:46 +00:00 by jabber.developer · 1 comment
jabber.developer commented 2026-01-21 16:05:46 +00:00
Owner
Copy Link

These lines disable TLS certificate verification:

git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
git clone --depth 1 -c http.sslverify=false https://github.com/strophe/libstrophe

Why this is insecure

Disabling http.sslVerify allows man-in-the-middle attacks: attackers can impersonate the server, tamper with downloaded code, or steal credentials (if auth is ever added).

This creates supply-chain risk during CI/builds.

Fix

  1. Remove -c http.sslverify=false
  2. Add ca-certificates packages so servers can verify GH and our website's certificates via root chain.
These lines disable TLS certificate verification: ```bash git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber git clone --depth 1 -c http.sslverify=false https://github.com/strophe/libstrophe ``` ### Why this is insecure Disabling `http.sslVerify` allows man-in-the-middle attacks: attackers can impersonate the server, tamper with downloaded code, or steal credentials (if auth is ever added). This creates supply-chain risk during CI/builds. ### Fix 1. Remove `-c http.sslverify=false` 2. Add `ca-certificates` packages so servers can verify GH and our website's certificates via root chain.
jabber.developer self-assigned this 2026-01-21 16:17:05 +00:00
jabber.developer added this to the Plans (2025-2026) project 2026-01-21 16:17:09 +00:00
jabber.developer added the
Kind/Security
Priority
Low
4
Reviewed
Confirmed
1
 labels 2026-01-21 16:17:31 +00:00
jabber.developer moved this to Verification in Plans (2025-2026) on 2026-01-21 16:18:00 +00:00
jabber.developer added the due date 2026-01-21 2026-01-21 16:19:00 +00:00
jabber.developer commented 2026-01-21 17:55:14 +00:00
Author
Owner
Copy Link

Resolved by #75

Resolved by #75
jabber.developer moved this to Done in Plans (2025-2026) on 2026-01-21 17:55:43 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
Kind/Bug
Something is not working
Kind/Documentation
Documentation changes
Kind/Enhancement
Improve existing functionality
Kind/Feature
New functionality
Kind/Security
This is security issue
Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
No Label
Kind/Security
Priority
Low
4
Reviewed
Confirmed
1
Milestone
No items
No Milestone
Projects
Clear projects
No project Plans (2025-2026)
Assignees
Clear assignees
admin jabber.developer jabber.developer2
No Assignees jabber.developer
1 Participants
Notifications
Due Date
2026-01-21
Dependencies

No dependencies set.

Reference: devs/cproof#74
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?