From c25e9e3b72b8931cafce263c29e8cef9a6e9b786 Mon Sep 17 00:00:00 2001
From: Evgeny Poberezkin <2769109+epoberezkin@users.noreply.github.com>
Date: Wed, 17 Jan 2024 15:23:43 +0000
Subject: [PATCH] scripts: curl/wget security (#3693)

---
 scripts/android/download-libs.sh           |  4 ++--
 scripts/desktop/build-lib-mac.sh           |  2 +-
 scripts/desktop/make-appimage-linux.sh     |  2 +-
 scripts/desktop/prepare-openssl-windows.sh |  2 +-
 scripts/desktop/prepare-vlc-linux.sh       | 10 +++++-----
 scripts/desktop/prepare-vlc-mac.sh         |  2 +-
 scripts/desktop/prepare-vlc-windows.sh     |  2 +-
 scripts/ios/download-libs.sh               |  2 +-
 8 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/scripts/android/download-libs.sh b/scripts/android/download-libs.sh
index 4702f03600..5b9e1036fb 100755
--- a/scripts/android/download-libs.sh
+++ b/scripts/android/download-libs.sh
@@ -37,12 +37,12 @@ for ((i = 0 ; i < ${#arches[@]}; i++)); do
 
     mkdir -p "$output_dir" 2> /dev/null
 
-    curl --location -o libsupport.zip $job_repo/$arch-android:lib:support.x86_64-linux/latest/download/1 && \
+    curl --tlsv1.2 --location -o libsupport.zip $job_repo/$arch-android:lib:support.x86_64-linux/latest/download/1 && \
     unzip -o libsupport.zip && \
     mv libsupport.so "$output_dir" && \
     rm libsupport.zip
 
-    curl --location -o libsimplex.zip "$job_repo"/"$arch"-android:lib:simplex-chat.x86_64-linux/latest/download/1 && \
+    curl --tlsv1.2 --location -o libsimplex.zip "$job_repo"/"$arch"-android:lib:simplex-chat.x86_64-linux/latest/download/1 && \
     unzip -o libsimplex.zip && \
     mv libsimplex.so "$output_dir" && \
     rm libsimplex.zip
diff --git a/scripts/desktop/build-lib-mac.sh b/scripts/desktop/build-lib-mac.sh
index 1a4deced4a..55e5ca6f3a 100755
--- a/scripts/desktop/build-lib-mac.sh
+++ b/scripts/desktop/build-lib-mac.sh
@@ -32,7 +32,7 @@ mkdir deps 2> /dev/null || true
   cp /tmp/libffi-3.4.4/*-apple-darwin*/.libs/libffi.dylib $BUILD/deps || \
     ( \
     cd /tmp && \
-    curl "https://gitlab.haskell.org/ghc/libffi-tarballs/-/raw/libffi-3.4.4/libffi-3.4.4.tar.gz?inline=false" -o libffi.tar.gz && \
+    curl --tlsv1.2 "https://gitlab.haskell.org/ghc/libffi-tarballs/-/raw/libffi-3.4.4/libffi-3.4.4.tar.gz?inline=false" -o libffi.tar.gz && \
     tar -xzvf libffi.tar.gz && \
     cd "libffi-3.4.4" && \
     ./configure && \
diff --git a/scripts/desktop/make-appimage-linux.sh b/scripts/desktop/make-appimage-linux.sh
index 9cd6f525f5..3bbdd65b49 100755
--- a/scripts/desktop/make-appimage-linux.sh
+++ b/scripts/desktop/make-appimage-linux.sh
@@ -37,7 +37,7 @@ cp *imple*.desktop usr/share/applications/
 cp $multiplatform_dir/desktop/src/jvmMain/resources/distribute/*.appdata.xml usr/share/metainfo
 
 if [ ! -f ../appimagetool-x86_64.AppImage ]; then
-    wget https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage -O ../appimagetool-x86_64.AppImage
+    wget --secure-protocol=TLSv1_3 https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage -O ../appimagetool-x86_64.AppImage
     chmod +x ../appimagetool-x86_64.AppImage
 fi
 ../appimagetool-x86_64.AppImage .
diff --git a/scripts/desktop/prepare-openssl-windows.sh b/scripts/desktop/prepare-openssl-windows.sh
index 79822d3ff5..942646853f 100644
--- a/scripts/desktop/prepare-openssl-windows.sh
+++ b/scripts/desktop/prepare-openssl-windows.sh
@@ -12,7 +12,7 @@ cd $root_dir
 if [ ! -f dist-newstyle/openssl-1.1.1w/libcrypto-1_1-x64.dll ]; then
     mkdir dist-newstyle 2>/dev/null || true
     cd dist-newstyle
-    curl https://www.openssl.org/source/openssl-1.1.1w.tar.gz -o openssl.tar.gz
+    curl --tlsv1.2 https://www.openssl.org/source/openssl-1.1.1w.tar.gz -o openssl.tar.gz
     $WINDIR\\System32\\tar.exe -xvzf openssl.tar.gz
     cd openssl-1.1.1w
     ./Configure mingw64
diff --git a/scripts/desktop/prepare-vlc-linux.sh b/scripts/desktop/prepare-vlc-linux.sh
index a76486150c..dae1c9255d 100755
--- a/scripts/desktop/prepare-vlc-linux.sh
+++ b/scripts/desktop/prepare-vlc-linux.sh
@@ -14,7 +14,7 @@ mkdir $vlc_dir || exit 0
 cd /tmp
 mkdir tmp 2>/dev/null || true
 cd tmp
-curl https://github.com/cmatomic/VLCplayer-AppImage/releases/download/3.0.11.1/VLC_media_player-3.0.11.1-x86_64.AppImage -L -o appimage
+curl --tlsv1.2 https://github.com/cmatomic/VLCplayer-AppImage/releases/download/3.0.11.1/VLC_media_player-3.0.11.1-x86_64.AppImage -L -o appimage
 chmod +x appimage
 ./appimage --appimage-extract
 cp -r squashfs-root/usr/lib/* $vlc_dir
@@ -28,7 +28,7 @@ cd /tmp
 (
 mkdir tmp
 cd tmp
-curl http://archive.ubuntu.com/ubuntu/pool/universe/v/vlc/libvlc5_3.0.9.2-1_amd64.deb -o libvlc
+curl --tlsv1.2 https://archive.ubuntu.com/ubuntu/pool/universe/v/vlc/libvlc5_3.0.9.2-1_amd64.deb -o libvlc
 ar p libvlc data.tar.xz > data.tar.xz
 tar -xvf data.tar.xz
 mv usr/lib/x86_64-linux-gnu/libvlc.so{.5,}
@@ -40,7 +40,7 @@ rm -rf tmp
 (
 mkdir tmp
 cd tmp
-curl http://archive.ubuntu.com/ubuntu/pool/universe/v/vlc/libvlccore9_3.0.9.2-1_amd64.deb -o libvlccore
+curl --tlsv1.2 https://archive.ubuntu.com/ubuntu/pool/universe/v/vlc/libvlccore9_3.0.9.2-1_amd64.deb -o libvlccore
 ar p libvlccore data.tar.xz > data.tar.xz
 tar -xvf data.tar.xz
 cp usr/lib/x86_64-linux-gnu/libvlccore.so* $vlc_dir
@@ -51,7 +51,7 @@ rm -rf tmp
 (
 mkdir tmp
 cd tmp
-curl http://mirrors.edge.kernel.org/ubuntu/pool/universe/v/vlc/vlc-plugin-base_3.0.9.2-1_amd64.deb -o plugins
+curl --tlsv1.2 https://mirrors.edge.kernel.org/ubuntu/pool/universe/v/vlc/vlc-plugin-base_3.0.9.2-1_amd64.deb -o plugins
 ar p plugins data.tar.xz > data.tar.xz
 tar -xvf data.tar.xz
 find usr/lib/x86_64-linux-gnu/vlc/plugins/ -name "lib*.so*" -exec patchelf --set-rpath '$ORIGIN/../../' {} \;
@@ -63,7 +63,7 @@ rm -rf tmp
 (
 mkdir tmp
 cd tmp
-curl http://archive.ubuntu.com/ubuntu/pool/main/libi/libidn/libidn11_1.33-2.2ubuntu2_amd64.deb -o idn
+curl --tlsv1.2 https://archive.ubuntu.com/ubuntu/pool/main/libi/libidn/libidn11_1.33-2.2ubuntu2_amd64.deb -o idn
 ar p idn data.tar.xz > data.tar.xz
 tar -xvf data.tar.xz
 cp lib/x86_64-linux-gnu/lib* $vlc_dir
diff --git a/scripts/desktop/prepare-vlc-mac.sh b/scripts/desktop/prepare-vlc-mac.sh
index 25ec1365fc..288b5a1a7d 100755
--- a/scripts/desktop/prepare-vlc-mac.sh
+++ b/scripts/desktop/prepare-vlc-mac.sh
@@ -23,7 +23,7 @@ mkdir -p $vlc_dir/vlc || exit 0
 cd /tmp
 mkdir tmp 2>/dev/null || true
 cd tmp
-curl https://github.com/simplex-chat/vlc/releases/download/v$vlc_version/vlc-macos-$ARCH.zip -L -o vlc
+curl --tlsv1.2 https://github.com/simplex-chat/vlc/releases/download/v$vlc_version/vlc-macos-$ARCH.zip -L -o vlc
 unzip -oqq vlc
 install_name_tool -add_rpath "@loader_path/VLC.app/Contents/MacOS/lib" vlc-cache-gen
 cd VLC.app/Contents/MacOS/lib
diff --git a/scripts/desktop/prepare-vlc-windows.sh b/scripts/desktop/prepare-vlc-windows.sh
index 680fa7b803..7d2a71a952 100644
--- a/scripts/desktop/prepare-vlc-windows.sh
+++ b/scripts/desktop/prepare-vlc-windows.sh
@@ -13,7 +13,7 @@ mkdir -p $vlc_dir/vlc || exit 0
 cd /tmp
 mkdir tmp 2>/dev/null || true
 cd tmp
-curl https://irltoolkit.mm.fcix.net/videolan-ftp/vlc/3.0.18/win64/vlc-3.0.18-win64.zip -L -o vlc
+curl --tlsv1.2 https://irltoolkit.mm.fcix.net/videolan-ftp/vlc/3.0.18/win64/vlc-3.0.18-win64.zip -L -o vlc
 $WINDIR\\System32\\tar.exe -xf vlc
 cd vlc-*
 # Setting the same date as the date that will be on the file after extraction from JAR to make VLC cache checker happy
diff --git a/scripts/ios/download-libs.sh b/scripts/ios/download-libs.sh
index 9d7e388870..d0a3c9c621 100755
--- a/scripts/ios/download-libs.sh
+++ b/scripts/ios/download-libs.sh
@@ -35,7 +35,7 @@ for ((i = 0 ; i < ${#arches[@]}; i++)); do
     output_arch="${output_arches[$i]}"
     output_dir="$HOME/Downloads"
 
-    curl --location -o "$output_dir"/pkg-ios-"$arch"-swift-json.zip "$job_repo"/"$arch"-darwin-ios:lib:simplex-chat."$arch"-darwin/latest/download/1 && \
+    curl --tlsv1.2 --location -o "$output_dir"/pkg-ios-"$arch"-swift-json.zip "$job_repo"/"$arch"-darwin-ios:lib:simplex-chat."$arch"-darwin/latest/download/1 && \
     unzip -o "$output_dir"/pkg-ios-"$output_arch"-swift-json.zip -d ~/Downloads/pkg-ios-"$output_arch"-swift-json
 done
 sh "$root_dir"/scripts/ios/prepare-x86_64.sh