Installer shell script downloads keys over HTTP (not HTTPS) about sysdig HOT 4 CLOSED

Good catch!

Problem is we use S3 to host our repository so we can't get HTTPS for download.draios.com, so I'll just move the key to another location or use the full s3.amazonaws.com name.

Thanks for reporting this!

from sysdig.

Meanwhile you can use https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public

from sysdig.

So this should be fixed in 98e1970.
I also updated our wiki and website so the entire installer is fetched from HTTPS and a potential MITM is avoided there as well.
Unfortunately the URLs look less pretty but that's S3.

Thanks!

from sysdig.

Awesome! Thanks for the quick response.

On Thu, Apr 3, 2014 at 3:33 PM, Gianluca Borello
[email protected]:

So this should be fixed in 98e197098e1970498
.
I also updated our wiki and website so the entire installer is fetched
from HTTPS and a potential MITM is avoided there as well.
Unfortunately the URLs look less pretty but that's S3.

Thanks!

Reply to this email directly or view it on GitHubhttps://github.com//issues/29#issuecomment-39494790
.

from sysdig.