security: verify SHA256 of juliaup's own tarball before extraction - #1456

Draft

IanButterworth wants to merge 8 commits into

mainfrom

ib/security_verify_installs

Commits on Mar 25, 2026

security: abort tar extraction on non-Normal path components

IanButterworth
and
claude
committed
fa29744
security: enforce HTTPS for JULIAUP_SERVER / JULIAUP_NIGHTLY_SERVER and log when set

IanButterworth
and
claude
committed
a9fd02b
test: add unit tests for tar path-traversal abort and HTTPS enforcement

IanButterworth
and
claude
committed
114dfa0
fix(test): correct unpack unit tests

IanButterworth
and
claude
committed
977af7b
fix test race
IanButterworth
committed
1306e0a
fix(test): remove hardcoded patch version in command_update assertions

IanButterworth
and
claude
committed
8cdfdb2
security: verify SHA256 of juliaup archive before extraction

IanButterworth
and
claude
committed
d85ebd6
Update .gitignore
IanButterworth
committed
d345c65