全 download.sh の https 化と --no-check-certificate の削除 (#167 その1) - #173
Open
k-yoshimi wants to merge 2 commits into
Open
全 download.sh の https 化と --no-check-certificate の削除 (#167 その1)#173k-yoshimi wants to merge 2 commits into
k-yoshimi wants to merge 2 commits into
Conversation
All download.sh scripts now fetch over https; the TLS verification bypass in tools/gsl/download.sh is removed. Every https URL was verified to return 200 for the currently pinned versions. Refs #167 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Phase 2 (Antigravity) review of PR #173 pointed out: - Add a network-environment note (https_proxy, CA certificates, offline placement into SOURCE_DIR) to how_to_use docs (en/ja) - get-cacert.sh fetched the CA bundle itself over http from the defunct curl.haxx.se; use https://curl.se/ca/cacert.pem - MALIVE_REPOSITORY_DEF switched to https for consistency (only referenced from misc/old/; removal is tracked in #185) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Collaborator
Author
AI review cycle (Codex + Antigravity) 結果Phase 1 (Codex, コード品質): must_fix 0 / should_fix 0。optional 2 件(checksum 検証→#167 残作業として追跡、旧 CA バンドル互換→意図したセキュリティ変更として受容)。 Phase 2 (Antigravity, docs/workflow): must_fix_docs 0。指摘を受けて追加コミット 3a976e8 で対応:
Phase 1 再レビュー(エスカレーション): must_fix 0。レビュアー指摘の → 両フェーズ収束。 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
#167 の第 1 段として、ダウンロード経路の暗号化を修正します。
download.sh（openmx, respack, salmon, boost, cmake, fftw, gsl, lapack, scalapack）の URL をhttp://→https://に変更tools/gsl/download.shのwget --no-check-certificate（TLS 検証無効化）を削除検証
現在 pin されているバージョンの実 URL 10 件すべてに対して HEAD リクエストを送り、https で HTTP 200 が返ることを確認済みです（openmx 本体+patch、respack 20240804、salmon 2.2.0、boost 1.90.0、fftw 3.3.10、cmake 3.26.4、gsl 2.6、lapack 3.9.0、scalapack 2.1.0）。
残作業（#167 は open のまま）
sha256 checksum 検証の導入（
version.shへの<NAME>_SHA256追加 +util.shの共通検証関数）は、全 tarball の取得と checksum 採取が必要なため別 PR で対応します。🤖 Generated with Claude Code