From 3998dfde74e26534bd8d0362208fc627e3d8ef2a Mon Sep 17 00:00:00 2001 From: SRHTNIN Date: Fri, 9 Oct 2026 10:40:13 +0200 Subject: [PATCH] Self-update over HTTPS only --- Core.py | 2 +- SelfUpdate.py | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/Core.py b/Core.py index abb0521..9a0f215 100644 --- a/Core.py +++ b/Core.py @@ -16,7 +16,7 @@ import tomlkit AppName = "SaraSuite" # Compared with the latest Gitea release to offer self-updates (SelfUpdate.py). # Bump it, then run Packaging/Release.py, to publish a new SaraSuite. -AppVersion = "1.1.0" +AppVersion = "1.1.1" IsFrozen = bool(getattr(sys, "frozen", False)) # running from the AppImage # Bundled in assets/fonts and always registered, so it works as FontFamily # without being installed. Any other FontFamily is looked up among the diff --git a/SelfUpdate.py b/SelfUpdate.py index d2de97b..befc4d9 100644 --- a/SelfUpdate.py +++ b/SelfUpdate.py @@ -56,7 +56,12 @@ def LatestRelease() -> Optional[Release]: except SourceError: return None Asset = next((Item for Item in Data.get("assets", []) if Item.get("name") == AssetName), None) - return Release(Data.get("tag_name", ""), Asset.get("browser_download_url", "") if Asset else "") + AssetUrl = Asset.get("browser_download_url", "") if Asset else "" + # Gitea can hand out http:// download links; never fetch an executable + # over plain HTTP when the git host itself is HTTPS. + if Parts.scheme == "https" and AssetUrl.startswith("http://"): + AssetUrl = "https://" + AssetUrl.removeprefix("http://") + return Release(Data.get("tag_name", ""), AssetUrl) def Install(Latest: Release, Log: Callable[[str], None]) -> Path: