Chef/Security/InsecureRemoteFileSource

Cookstyle cops page

The Cookstyle cops department: Chef/Security

Files downloaded over plain HTTP or FTP can be modified in transit, and the resource will use whatever it receives. Fetch them over HTTPS so the transport is authenticated.

Where an HTTPS endpoint genuinely isn’t available, a checksum on the resource at least detects tampering, since the digest is compared before the file is used.

Examples

# bad
remote_file '/tmp/foo.tar.gz' do
  source 'http://example.com/foo.tar.gz'
end

# good
remote_file '/tmp/foo.tar.gz' do
  source 'https://example.com/foo.tar.gz'
end

Configurable attributes