Closed josecv closed 4 years ago
It is a component intended for testing-only purposes, so I don't think it is a critical issue. Moreover, if someone hacks the target server, using https protocol will not guarantee the security of downloaded data. A safer solution is to check the hash of the downloaded data and compare it with an expected value. Which would make the release process more complicated.
The
repack-postgres.sh
script downloads postgres binaries fromhttp://get.enterprisedb.com
, instead ofhttps
. This doesn't inspire much confidence in the integrity of the binary I'm running in my machine. Should probably be changed to use https.