From 6ed0a4902aa6f2ec45cef7b6615fdf0fe4a69c0c Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 11 Nov 2026 18:34:24 +0000
Subject: [PATCH] Enforce HTTPS on VICAR release downloads in the runtime and
 builder images

curl followed redirects with any protocol, so a redirect to plain HTTP
would have been fetched. --proto =https limits the initial request and
every redirect to HTTPS, --tlsv1.2 sets the TLS floor, and -f fails the
build on an HTTP error instead of handing an error page to tar.

Co-Authored-By: jason.han <hanhuijun@gmail.com>
---
 terrain-intelligence-generator/builder/Dockerfile | 4 ++--
 terrain-intelligence-generator/docker/Dockerfile  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/terrain-intelligence-generator/builder/Dockerfile b/terrain-intelligence-generator/builder/Dockerfile
index 6dba195..08b4beb 100644
--- a/terrain-intelligence-generator/builder/Dockerfile
+++ b/terrain-intelligence-generator/builder/Dockerfile
@@ -50,7 +50,7 @@ RUN rm -f /bin/csh && ln -s /bin/tcsh /bin/csh
 # The binaries tarball ships the sources too, so $V2TOP/mars/src/prog and
 # $V2TOP/p2/prog are available as a reference tree to copy a unit from.
 RUN echo "Downloading VICAR binaries and sources..." && \
-    curl -L "https://github.com/NASA-AMMOS/VICAR/releases/download/${VICAR_VERSION}/${BINARIES_FILE}" -o /tmp/vicar_bin.tar.gz && \
+    curl --proto "=https" --tlsv1.2 -fL "https://github.com/NASA-AMMOS/VICAR/releases/download/${VICAR_VERSION}/${BINARIES_FILE}" -o /tmp/vicar_bin.tar.gz && \
     mkdir -p ${V2TOP} && cd /tmp && tar -xzf vicar_bin.tar.gz && \
     EXTRACTED_DIR=$(ls -d vicar_open_bin_* 2>/dev/null | head -1) && \
     if [ -d "$EXTRACTED_DIR/vicar_open_${VICAR_VERSION}" ]; then \
@@ -62,7 +62,7 @@ RUN echo "Downloading VICAR binaries and sources..." && \
     echo "✓ VICAR $(du -sh ${V2TOP} | cut -f1) unpacked"
 
 RUN echo "Downloading VICAR external libraries..." && \
-    curl -L "https://github.com/NASA-AMMOS/VICAR/releases/download/${VICAR_VERSION}/${EXTERNAL_FILE}" -o /tmp/vicar_ext.tar.gz && \
+    curl --proto "=https" --tlsv1.2 -fL "https://github.com/NASA-AMMOS/VICAR/releases/download/${VICAR_VERSION}/${EXTERNAL_FILE}" -o /tmp/vicar_ext.tar.gz && \
     mkdir -p ${WORKSPACE}/external && cd /tmp && tar -xzf vicar_ext.tar.gz && \
     EXTRACTED_DIR=$(ls -d vicar_open_ext_* 2>/dev/null | head -1) && \
     CONTENT_COUNT=$(find "$EXTRACTED_DIR" -maxdepth 1 -mindepth 1 | wc -l) && \
diff --git a/terrain-intelligence-generator/docker/Dockerfile b/terrain-intelligence-generator/docker/Dockerfile
index e3a6a17..8b77e08 100644
--- a/terrain-intelligence-generator/docker/Dockerfile
+++ b/terrain-intelligence-generator/docker/Dockerfile
@@ -23,7 +23,7 @@ RUN dnf install -y curl tar gzip && \
 
 # Download and extract VICAR binaries
 RUN echo "Downloading VICAR binaries..." && \
-    curl -L "https://github.com/NASA-AMMOS/VICAR/releases/download/${VICAR_VERSION}/${BINARIES_FILE}" -o vicar_bin.tar.gz && \
+    curl --proto "=https" --tlsv1.2 -fL "https://github.com/NASA-AMMOS/VICAR/releases/download/${VICAR_VERSION}/${BINARIES_FILE}" -o vicar_bin.tar.gz && \
     echo "Extracting VICAR binaries..." && \
     mkdir -p /vicar/dev && \
     tar -xzf vicar_bin.tar.gz && \
@@ -50,7 +50,7 @@ RUN echo "Downloading VICAR binaries..." && \
 
 # Download and extract VICAR external libraries
 RUN echo "Downloading VICAR external libraries..." && \
-    curl -L "https://github.com/NASA-AMMOS/VICAR/releases/download/${VICAR_VERSION}/${EXTERNAL_FILE}" -o vicar_ext.tar.gz && \
+    curl --proto "=https" --tlsv1.2 -fL "https://github.com/NASA-AMMOS/VICAR/releases/download/${VICAR_VERSION}/${EXTERNAL_FILE}" -o vicar_ext.tar.gz && \
     echo "Extracting VICAR external libraries..." && \
     mkdir -p /vicar/external && \
     tar -xzf vicar_ext.tar.gz && \