From bfec7e2a70fa0bcf4e6c511f5f9c507b960a6930 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Thu, 22 Oct 2026 22:46:49 -0400 Subject: [PATCH] security: fetch amd64 security updates over HTTPS (SonarCloud S5332) (#68) The amd64 security source added in #61 used http://security.ubuntu.com, reintroducing the clear-text apt source that #26 removed for ports.ubuntu.com. security.ubuntu.com serves the same archive over HTTPS. --- actions/install-riscv64-cross/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/actions/install-riscv64-cross/action.yml b/actions/install-riscv64-cross/action.yml index a900c34..ff6fee2 100644 --- a/actions/install-riscv64-cross/action.yml +++ b/actions/install-riscv64-cross/action.yml @@ -24,7 +24,7 @@ runs: # publishes security updates as soon as security.ubuntu.com does, but the runner's amd64 mirror # (azure.archive.ubuntu.com) lags for hours, so apt finds no matching pair ("held broken # packages"). Read amd64 security updates from the primary too, so both sides can match. - echo "deb [arch=amd64] http://security.ubuntu.com/ubuntu $VERSION_CODENAME-security main universe restricted multiverse" \ + echo "deb [arch=amd64] https://security.ubuntu.com/ubuntu $VERSION_CODENAME-security main universe restricted multiverse" \ | sudo tee /etc/apt/sources.list.d/amd64-security.list sudo apt-get update sudo apt-get install -y --no-install-recommends \