voxpupuli/puppet-confluence

Should default to https for Confluence download URL

Closed this issue · 4 comments

dlmetcalf commented

As it's pulling down executable code, the use of http (unauthenticated server) for downloading Confluence tgz is insecure and open to MITM abuse. This is a bigger issue too because puppet's extracts etc are often running as a privileged user and there's no checksum/integrity verification available on the downloads (i.e. sha256sum's aren't published).

Recommend changing default:
downloadURL => 'http://www.atlassian.com/software/confluence/downloads/binary/'
to
downloadURL => 'https://www.atlassian.com/software/confluence/downloads/binary/'

I understand http might occasionally be preferable to achieve web proxy cache hits for download performance. I've commented on https://jira.atlassian.com/browse/CONF-25687 and voted for getting sha256sum's published (over https), so http downloads might become an option again in future.

igalic commented

👍 would you like to submit this as pr?

TJM commented

this appears to have been resolved already

hdep commented

I confirm the URL is set to :

$download_url = 'https://www.atlassian.com/software/confluence/downloads/binary',

It would be good to close this issue in order to know what works this module still need.