A 1097f055c3 fix(security): add --proto '=https' to all curl executable downloads (#2160) ... 42 curl calls downloading JS bundles, CLI binaries, and gh CLI tarballs were missing --proto '=https', allowing protocol downgrade attacks on hostile networks. PR #2138 fixed bun installer calls; this closes the remaining gap for executable downloads. Fixes applied: - sh/{sprite,aws,gcp,hetzner,daytona,local}/{claude,codex,openclaw,opencode,kilocode,hermes,zeroclaw}.sh (42 files) - sh/cli/install.sh (cli.js download) - sh/shared/github-auth.sh (keyring, API, tarball downloads) Agent: security-auditor Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-03-03 23:38:03 -05:00
..
aws	fix(security): add --proto '=https' to all curl executable downloads (#2160)	2026-03-03 23:38:03 -05:00
cli	fix(security): add --proto '=https' to all curl executable downloads (#2160)	2026-03-03 23:38:03 -05:00
daytona	fix(security): add --proto '=https' to all curl executable downloads (#2160)	2026-03-03 23:38:03 -05:00
digitalocean	refactor: convert hermes scripts to thin-wrapper pattern (#2094)	2026-03-01 20:27:59 -08:00
docker	fix(security): add --proto '=https' to all curl bun installer calls (#2138)	2026-03-03 11:52:54 -08:00
e2e	fix(e2e): pass env_b64 via printf stdin to eliminate interpolation risk (#2159)	2026-03-03 19:34:31 -08:00
gcp	fix(security): add --proto '=https' to all curl executable downloads (#2160)	2026-03-03 23:38:03 -05:00
hetzner	fix(security): add --proto '=https' to all curl executable downloads (#2160)	2026-03-03 23:38:03 -05:00
local	fix(security): add --proto '=https' to all curl executable downloads (#2160)	2026-03-03 23:38:03 -05:00
shared	fix(security): add --proto '=https' to all curl executable downloads (#2160)	2026-03-03 23:38:03 -05:00
sprite	fix(security): add --proto '=https' to all curl executable downloads (#2160)	2026-03-03 23:38:03 -05:00
test	refactor: Remove dead code and stale references (#2062)	2026-03-01 11:45:24 -05:00