devs/cproof
1
2
Fork 1
Code Issues 43 Pull Requests 6 Actions Packages Projects 1 Releases Wiki Activity

fix: secure git clones by removing insecure sslverify flag (#74) #75

Manually merged
jabber.developer merged 1 commits from ci/secure-cloning into master 2026-01-21 17:01:09 +00:00
Conversation 1 Commits 1 Files Changed 5 +13 -8
jabber.developer commented 2026-01-21 16:15:29 +00:00
Owner
Copy Link

What this PR will do

  • Remove -c http.sslverify=false from all git clones
    (enables proper TLS verification, closes MITM risk).
  • Explicitly install ca-certificates in every CI Docker image.

Why this matters

Disabling TLS certificate verification allowed potential man-in-the-middle attacks during dependency fetching, creating a supply-chain risk.
Explicitly installing ca-certificates ensures the system trust store is present and populated, so Git can verify HTTPS connections using default settings — even on minimal base images.

Resolves #74

## What this PR will do - Remove -c http.sslverify=false from all git clones (enables proper TLS verification, closes MITM risk). - Explicitly install ca-certificates in every CI Docker image. ## Why this matters Disabling TLS certificate verification allowed potential man-in-the-middle attacks during dependency fetching, creating a supply-chain risk. Explicitly installing ca-certificates ensures the system trust store is present and populated, so Git can verify HTTPS connections using default settings — even on minimal base images. Resolves #74
jabber.developer added 1 commit 2026-01-21 16:15:30 +00:00
fix(ci): remove insecure git clone flag, add ca-certificates
All checks were successful
CI Code / Check spelling (pull_request) Successful in 22s
Details
CI Code / Check coding style (pull_request) Successful in 34s
Details
CI Code / Code Coverage (pull_request) Successful in 17m45s
Details
CI Code / Linux (ubuntu) (pull_request) Successful in 18m1s
Details
CI Code / Linux (debian) (pull_request) Successful in 18m17s
Details
CI Code / Linux (arch) (pull_request) Successful in 19m0s
Details
CI Code / Check spelling (push) Successful in 19s
Details
CI Code / Check coding style (push) Successful in 31s
Details
CI Code / Code Coverage (push) Successful in 15m28s
Details
CI Code / Linux (ubuntu) (push) Successful in 18m11s
Details
CI Code / Linux (debian) (push) Successful in 18m22s
Details
CI Code / Linux (arch) (push) Successful in 20m51s
Details
8353a29b4f 
Remove -c http.sslverify=false from all git clones
(enables proper TLS verification, closes MITM risk).
Explicitly install ca-certificates in every CI Docker image.
jabber.developer requested review from jabber.developer2 2026-01-21 16:16:00 +00:00
jabber.developer2 approved these changes 2026-01-21 16:49:11 +00:00
jabber.developer2 left a comment
Collaborator
Copy Link

Approved — Removes insecure sslverify=false flag and adds ca-certificates for proper SSL verification.

Approved — Removes insecure sslverify=false flag and adds ca-certificates for proper SSL verification.
jabber.developer manually merged commit 8353a29b4f into master 2026-01-21 17:01:09 +00:00
jabber.developer deleted branch ci/secure-cloning 2026-01-21 17:01:21 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
jabber.developer2
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
Kind/Bug
Something is not working
Kind/Documentation
Documentation changes
Kind/Enhancement
Improve existing functionality
Kind/Feature
New functionality
Kind/Security
This is security issue
Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
admin jabber.developer jabber.developer2
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: devs/cproof#75
No description provided.
Delete Branch "ci/secure-cloning"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?