vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-05-01 21:30:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

fix: add --proto '=https' to remaining curl commands in install.sh and github-auth.sh (#2351)

Browse source 
Fixes #2350: Cloud agent scripts (AWS, GCP, Hetzner, Local, Sprite) already
had this flag from prior fixes. This commit adds the missing --proto '=https'
to user-facing curl instructions in sh/cli/install.sh (3 echo lines, 2 comment
lines) and usage comments in sh/shared/github-auth.sh (3 comment lines) to
prevent protocol downgrade attacks.

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-03-08 15:43:25 -07:00 • committed by GitHub
parent f159333ee9
commit e11918be59
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

6
sh/shared/github-auth.sh
View file

@ -3,11 +3,11 @@
# Executable directly via curl|bash; also sourceable using the CDN URL with eval.
#
# Usage (via curl|bash — recommended):
# curl -fsSL https://openrouter.ai/labs/spawn/shared/github-auth.sh | bash
# curl -fsSL https://raw.githubusercontent.com/OpenRouterTeam/spawn/main/sh/shared/github-auth.sh | bash
# curl -fsSL --proto '=https' https://openrouter.ai/labs/spawn/shared/github-auth.sh | bash
# curl -fsSL --proto '=https' https://raw.githubusercontent.com/OpenRouterTeam/spawn/main/sh/shared/github-auth.sh | bash
#
# Usage (sourced using absolute path or CDN URL):
# eval "$(curl -fsSL https://openrouter.ai/labs/spawn/shared/github-auth.sh)"
# eval "$(curl -fsSL --proto '=https' https://openrouter.ai/labs/spawn/shared/github-auth.sh)"
# ensure_github_auth
# ============================================================