[SPARK-9417] sbt-launch to fetch sbt binaries over https not http

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.5.0
• Component/s: Build
• Assignee: Sean R. Owen
• Reporter: Steve Loughran
• Created: 28/Jul/15 19:59
• Updated: 10/Nov/15 22:53
• Resolved: 10/Nov/15 22:53

Description

the current build/sbt-launch-lib.bash uses two URLs to try and fetch sbt from

  URL1=http://typesafe.artifactoryonline.com/typesafe/ivy-releases/org.scala-sbt/sbt-launch/${SBT_VERSION}/sbt-launch.jar
  URL2=http://repo.typesafe.com/typesafe/ivy-releases/org.scala-sbt/sbt-launch/${SBT_VERSION}/sbt-launch.jar

Using HTTP means that the artifacts are downloaded without any auth, and without any checksum validation. Yet the actual URL currently just redirects to URL https://repo.typesafe.com/typesafe/ivy-releases/

switching to that directly would reduce vulnerability to MITM publishing of subverted artifacts -or at least postpone it to the maven/ivy phase.

An alternative strategy would be to have the SHA1 checksum in the script, and explicitly validate the D/L

Issue Links

• relates to: SPARK-9254 sbt-launch-lib.bash should use `curl --location` to support HTTP/HTTPS redirection