From 2ca9e6f90f3609fda07f6ddba167379270e3caa9 Mon Sep 17 00:00:00 2001 From: msukkari Date: Thu, 10 Sep 2026 21:24:02 -0700 Subject: [PATCH 1/3] fix: preserve supplied Sourcebot install ID --- .github/scripts/test-entrypoint-install-id.sh | 94 +++++++++++++++++++ .github/workflows/test.yml | 2 + entrypoint.sh | 4 +- 3 files changed, 99 insertions(+), 1 deletion(-) create mode 100755 .github/scripts/test-entrypoint-install-id.sh diff --git a/.github/scripts/test-entrypoint-install-id.sh b/.github/scripts/test-entrypoint-install-id.sh new file mode 100755 index 000000000..949c330fd --- /dev/null +++ b/.github/scripts/test-entrypoint-install-id.sh @@ -0,0 +1,94 @@ +#!/usr/bin/env bash +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)" +TEST_ROOT=$(mktemp -d) +trap 'rm -rf "$TEST_ROOT"' EXIT + +FAKE_BIN="$TEST_ROOT/bin" +UUIDGEN_LOG="$TEST_ROOT/uuidgen.log" +mkdir -p "$FAKE_BIN" +: > "$UUIDGEN_LOG" + +cat > "$FAKE_BIN/uuidgen" <<'EOF' +#!/usr/bin/env bash +printf 'called\n' >> "$UUIDGEN_LOG" +printf 'generated-install-id\n' +EOF + +cat > "$FAKE_BIN/yarn" <<'EOF' +#!/usr/bin/env bash +exit 0 +EOF + +cat > "$FAKE_BIN/mkdir" <<'EOF' +#!/usr/bin/env bash +exit 0 +EOF + +cat > "$FAKE_BIN/supervisord" <<'EOF' +#!/usr/bin/env bash +printf '%s\n' "$SOURCEBOT_INSTALL_ID" > "$RESULT_FILE" +EOF + +chmod +x "$FAKE_BIN/uuidgen" "$FAKE_BIN/yarn" "$FAKE_BIN/mkdir" "$FAKE_BIN/supervisord" + +run_entrypoint() { + local data_dir="$1" + local result_file="$2" + shift 2 + + env \ + PATH="$FAKE_BIN:$PATH" \ + UUIDGEN_LOG="$UUIDGEN_LOG" \ + RESULT_FILE="$result_file" \ + DATA_CACHE_DIR="$data_dir" \ + DATABASE_URL="postgresql://test" \ + REDIS_URL="redis://test" \ + SOURCEBOT_ENCRYPTION_KEY="test-encryption-key" \ + AUTH_SECRET="test-auth-secret" \ + AUTH_URL="http://localhost:3000" \ + SOURCEBOT_TELEMETRY_DISABLED="true" \ + "$@" \ + /bin/sh "$REPO_ROOT/entrypoint.sh" >/dev/null +} + +assert_equals() { + local description="$1" + local actual="$2" + local expected="$3" + + if [[ "$actual" != "$expected" ]]; then + echo "FAIL: $description" + echo "Expected: $expected" + echo "Actual: $actual" + exit 1 + fi +} + +supplied_data="$TEST_ROOT/supplied-data" +supplied_result="$TEST_ROOT/supplied-result" +mkdir -p "$supplied_data" +run_entrypoint "$supplied_data" "$supplied_result" SOURCEBOT_INSTALL_ID="supplied-install-id" +assert_equals "uses the supplied install ID on first boot" "$(<"$supplied_result")" "supplied-install-id" +assert_equals "persists the supplied install ID" "$(jq -r '.install_id' "$supplied_data/.installedv3")" "supplied-install-id" +assert_equals "does not generate an ID when one is supplied" "$(wc -l < "$UUIDGEN_LOG" | tr -d ' ')" "0" + +generated_data="$TEST_ROOT/generated-data" +generated_result="$TEST_ROOT/generated-result" +mkdir -p "$generated_data" +run_entrypoint "$generated_data" "$generated_result" SOURCEBOT_INSTALL_ID="" +assert_equals "generates an install ID when none is supplied" "$(<"$generated_result")" "generated-install-id" +assert_equals "persists the generated install ID" "$(jq -r '.install_id' "$generated_data/.installedv3")" "generated-install-id" +assert_equals "generates exactly one install ID" "$(wc -l < "$UUIDGEN_LOG" | tr -d ' ')" "1" + +existing_data="$TEST_ROOT/existing-data" +existing_result="$TEST_ROOT/existing-result" +mkdir -p "$existing_data" +printf '{"version":"existing-version","install_id":"persisted-install-id"}\n' > "$existing_data/.installedv3" +run_entrypoint "$existing_data" "$existing_result" SOURCEBOT_INSTALL_ID="conflicting-install-id" +assert_equals "keeps the persisted install ID after first boot" "$(<"$existing_result")" "persisted-install-id" +assert_equals "does not generate another ID after first boot" "$(wc -l < "$UUIDGEN_LOG" | tr -d ' ')" "1" + +echo "Entrypoint install ID tests passed." diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 9fee4b6c7..d3ac20e85 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -20,6 +20,8 @@ jobs: run: .github/scripts/test-cve-remediation.sh - name: Test Zoekt sync automation run: .github/scripts/testZoektSync.sh + - name: Test entrypoint install ID behavior + run: .github/scripts/test-entrypoint-install-id.sh test: runs-on: ubuntu-latest diff --git a/entrypoint.sh b/entrypoint.sh index 7c3654e6a..b5aa8ae31 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -147,7 +147,9 @@ FIRST_RUN_FILE="$DATA_CACHE_DIR/.installedv3" if [ ! -f "$FIRST_RUN_FILE" ]; then touch "$FIRST_RUN_FILE" - export SOURCEBOT_INSTALL_ID=$(uuidgen) + if [ -z "$SOURCEBOT_INSTALL_ID" ]; then + export SOURCEBOT_INSTALL_ID=$(uuidgen) + fi # If this is our first run, send a `install` event to PostHog # (if telemetry is enabled) From 5496d1e8556a7e6940097d00879634ae00ed3303 Mon Sep 17 00:00:00 2001 From: msukkari Date: Thu, 10 Sep 2026 22:16:00 -0700 Subject: [PATCH 2/3] fix: safely serialize supplied install IDs --- .github/scripts/test-entrypoint-install-id.sh | 58 +++++++++++++++++-- entrypoint.sh | 46 ++++++++------- 2 files changed, 78 insertions(+), 26 deletions(-) diff --git a/.github/scripts/test-entrypoint-install-id.sh b/.github/scripts/test-entrypoint-install-id.sh index 949c330fd..c943839b2 100755 --- a/.github/scripts/test-entrypoint-install-id.sh +++ b/.github/scripts/test-entrypoint-install-id.sh @@ -8,15 +8,31 @@ trap 'rm -rf "$TEST_ROOT"' EXIT FAKE_BIN="$TEST_ROOT/bin" UUIDGEN_LOG="$TEST_ROOT/uuidgen.log" +CURL_PAYLOAD_FILE="$TEST_ROOT/curl-payload.json" mkdir -p "$FAKE_BIN" : > "$UUIDGEN_LOG" cat > "$FAKE_BIN/uuidgen" <<'EOF' #!/usr/bin/env bash +if [[ "${UUIDGEN_SHOULD_FAIL:-false}" == "true" ]]; then + exit 1 +fi printf 'called\n' >> "$UUIDGEN_LOG" printf 'generated-install-id\n' EOF +cat > "$FAKE_BIN/curl" <<'EOF' +#!/usr/bin/env bash +while (($# > 0)); do + if [[ "$1" == "-d" ]]; then + printf '%s\n' "$2" > "$CURL_PAYLOAD_FILE" + exit 0 + fi + shift +done +exit 1 +EOF + cat > "$FAKE_BIN/yarn" <<'EOF' #!/usr/bin/env bash exit 0 @@ -32,7 +48,7 @@ cat > "$FAKE_BIN/supervisord" <<'EOF' printf '%s\n' "$SOURCEBOT_INSTALL_ID" > "$RESULT_FILE" EOF -chmod +x "$FAKE_BIN/uuidgen" "$FAKE_BIN/yarn" "$FAKE_BIN/mkdir" "$FAKE_BIN/supervisord" +chmod +x "$FAKE_BIN/uuidgen" "$FAKE_BIN/curl" "$FAKE_BIN/yarn" "$FAKE_BIN/mkdir" "$FAKE_BIN/supervisord" run_entrypoint() { local data_dir="$1" @@ -42,6 +58,8 @@ run_entrypoint() { env \ PATH="$FAKE_BIN:$PATH" \ UUIDGEN_LOG="$UUIDGEN_LOG" \ + UUIDGEN_SHOULD_FAIL="false" \ + CURL_PAYLOAD_FILE="$CURL_PAYLOAD_FILE" \ RESULT_FILE="$result_file" \ DATA_CACHE_DIR="$data_dir" \ DATABASE_URL="postgresql://test" \ @@ -69,11 +87,31 @@ assert_equals() { supplied_data="$TEST_ROOT/supplied-data" supplied_result="$TEST_ROOT/supplied-result" +supplied_id=$'supplied"install\\id\nsecond-line' mkdir -p "$supplied_data" -run_entrypoint "$supplied_data" "$supplied_result" SOURCEBOT_INSTALL_ID="supplied-install-id" -assert_equals "uses the supplied install ID on first boot" "$(<"$supplied_result")" "supplied-install-id" -assert_equals "persists the supplied install ID" "$(jq -r '.install_id' "$supplied_data/.installedv3")" "supplied-install-id" +run_entrypoint "$supplied_data" "$supplied_result" SOURCEBOT_INSTALL_ID="$supplied_id" SOURCEBOT_TELEMETRY_DISABLED="false" POSTHOG_PAPIK="test-project-key" +assert_equals "uses the supplied install ID on first boot" "$(<"$supplied_result")" "$supplied_id" +assert_equals "persists the supplied install ID as valid JSON" "$(jq -r '.install_id' "$supplied_data/.installedv3")" "$supplied_id" assert_equals "does not generate an ID when one is supplied" "$(wc -l < "$UUIDGEN_LOG" | tr -d ' ')" "0" +if ! jq -e --arg expected "$supplied_id" \ + '.event == "install" and .distinct_id == $expected and .api_key == "test-project-key"' \ + "$CURL_PAYLOAD_FILE" >/dev/null; then + echo "FAIL: install telemetry payload did not safely encode the supplied install ID" + exit 1 +fi + +# Exercise the next-boot read and upgrade telemetry paths with the same escaped ID. +jq -n --arg install_id "$supplied_id" \ + '{version: "previous-version", install_id: $install_id}' > "$supplied_data/.installedv3" +supplied_restart_result="$TEST_ROOT/supplied-restart-result" +run_entrypoint "$supplied_data" "$supplied_restart_result" SOURCEBOT_INSTALL_ID="conflicting-install-id" SOURCEBOT_TELEMETRY_DISABLED="false" POSTHOG_PAPIK="test-project-key" +assert_equals "reads the escaped install ID on the next boot" "$(<"$supplied_restart_result")" "$supplied_id" +if ! jq -e --arg expected "$supplied_id" \ + '.event == "upgrade" and .distinct_id == $expected and .api_key == "test-project-key"' \ + "$CURL_PAYLOAD_FILE" >/dev/null; then + echo "FAIL: upgrade telemetry payload did not safely encode the persisted install ID" + exit 1 +fi generated_data="$TEST_ROOT/generated-data" generated_result="$TEST_ROOT/generated-result" @@ -91,4 +129,16 @@ run_entrypoint "$existing_data" "$existing_result" SOURCEBOT_INSTALL_ID="conflic assert_equals "keeps the persisted install ID after first boot" "$(<"$existing_result")" "persisted-install-id" assert_equals "does not generate another ID after first boot" "$(wc -l < "$UUIDGEN_LOG" | tr -d ' ')" "1" +failed_data="$TEST_ROOT/failed-data" +failed_result="$TEST_ROOT/failed-result" +mkdir -p "$failed_data" +if run_entrypoint "$failed_data" "$failed_result" SOURCEBOT_INSTALL_ID="" UUIDGEN_SHOULD_FAIL="true"; then + echo "FAIL: entrypoint succeeded when install ID generation failed" + exit 1 +fi +if [[ -e "$failed_data/.installedv3" ]]; then + echo "FAIL: entrypoint left an invalid first-run file after install ID generation failed" + exit 1 +fi + echo "Entrypoint install ID tests passed." diff --git a/entrypoint.sh b/entrypoint.sh index b5aa8ae31..63e5d3dbd 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -146,50 +146,52 @@ fi FIRST_RUN_FILE="$DATA_CACHE_DIR/.installedv3" if [ ! -f "$FIRST_RUN_FILE" ]; then - touch "$FIRST_RUN_FILE" if [ -z "$SOURCEBOT_INSTALL_ID" ]; then - export SOURCEBOT_INSTALL_ID=$(uuidgen) + SOURCEBOT_INSTALL_ID=$(uuidgen) fi + export SOURCEBOT_INSTALL_ID # If this is our first run, send a `install` event to PostHog # (if telemetry is enabled) if [ "$SOURCEBOT_TELEMETRY_DISABLED" = "false" ]; then - if ! ( curl -L --output /dev/null --silent --fail --header "Content-Type: application/json" -d '{ - "api_key": "'"$POSTHOG_PAPIK"'", - "event": "install", - "distinct_id": "'"$SOURCEBOT_INSTALL_ID"'", - "properties": { - "sourcebot_version": "'"$SOURCEBOT_VERSION"'" - } - }' https://us.i.posthog.com/capture/ ) then + INSTALL_EVENT_PAYLOAD=$(jq -n \ + --arg api_key "$POSTHOG_PAPIK" \ + --arg distinct_id "$SOURCEBOT_INSTALL_ID" \ + --arg sourcebot_version "$SOURCEBOT_VERSION" \ + '{api_key: $api_key, event: "install", distinct_id: $distinct_id, properties: {sourcebot_version: $sourcebot_version}}') + + if ! ( curl -L --output /dev/null --silent --fail --header "Content-Type: application/json" -d "$INSTALL_EVENT_PAYLOAD" https://us.i.posthog.com/capture/ ) then echo -e "\e[33m[Warning] Failed to send install event.\e[0m" fi fi else - export SOURCEBOT_INSTALL_ID=$(cat "$FIRST_RUN_FILE" | jq -r '.install_id') - PREVIOUS_VERSION=$(cat "$FIRST_RUN_FILE" | jq -r '.version') + SOURCEBOT_INSTALL_ID=$(jq -r '.install_id' "$FIRST_RUN_FILE") + export SOURCEBOT_INSTALL_ID + PREVIOUS_VERSION=$(jq -r '.version' "$FIRST_RUN_FILE") # If the version has changed, we assume an upgrade has occurred. if [ "$PREVIOUS_VERSION" != "$SOURCEBOT_VERSION" ]; then echo -e "\e[34m[Info] Upgraded from version $PREVIOUS_VERSION to $SOURCEBOT_VERSION\e[0m" if [ "$SOURCEBOT_TELEMETRY_DISABLED" = "false" ]; then - if ! ( curl -L --output /dev/null --silent --fail --header "Content-Type: application/json" -d '{ - "api_key": "'"$POSTHOG_PAPIK"'", - "event": "upgrade", - "distinct_id": "'"$SOURCEBOT_INSTALL_ID"'", - "properties": { - "from_version": "'"$PREVIOUS_VERSION"'", - "to_version": "'"$SOURCEBOT_VERSION"'" - } - }' https://us.i.posthog.com/capture/ ) then + UPGRADE_EVENT_PAYLOAD=$(jq -n \ + --arg api_key "$POSTHOG_PAPIK" \ + --arg distinct_id "$SOURCEBOT_INSTALL_ID" \ + --arg from_version "$PREVIOUS_VERSION" \ + --arg to_version "$SOURCEBOT_VERSION" \ + '{api_key: $api_key, event: "upgrade", distinct_id: $distinct_id, properties: {from_version: $from_version, to_version: $to_version}}') + + if ! ( curl -L --output /dev/null --silent --fail --header "Content-Type: application/json" -d "$UPGRADE_EVENT_PAYLOAD" https://us.i.posthog.com/capture/ ) then echo -e "\e[33m[Warning] Failed to send upgrade event.\e[0m" fi fi fi fi -echo "{\"version\": \"$SOURCEBOT_VERSION\", \"install_id\": \"$SOURCEBOT_INSTALL_ID\"}" > "$FIRST_RUN_FILE" +jq -n \ + --arg version "$SOURCEBOT_VERSION" \ + --arg install_id "$SOURCEBOT_INSTALL_ID" \ + '{version: $version, install_id: $install_id}' > "$FIRST_RUN_FILE" # Run a Database migration echo -e "\e[34m[Info] Running database migration...\e[0m" From 7ddc3d2010fbcc8bc20da0cc6339be5cbb1c91fa Mon Sep 17 00:00:00 2001 From: msukkari Date: Fri, 11 Sep 2026 11:32:55 -0700 Subject: [PATCH 3/3] fix: restrict telemetry redirects to HTTPS --- .github/scripts/test-entrypoint-install-id.sh | 53 ++++++++++++++++--- entrypoint.sh | 4 +- 2 files changed, 48 insertions(+), 9 deletions(-) diff --git a/.github/scripts/test-entrypoint-install-id.sh b/.github/scripts/test-entrypoint-install-id.sh index c943839b2..a0f62f5d0 100755 --- a/.github/scripts/test-entrypoint-install-id.sh +++ b/.github/scripts/test-entrypoint-install-id.sh @@ -9,8 +9,10 @@ trap 'rm -rf "$TEST_ROOT"' EXIT FAKE_BIN="$TEST_ROOT/bin" UUIDGEN_LOG="$TEST_ROOT/uuidgen.log" CURL_PAYLOAD_FILE="$TEST_ROOT/curl-payload.json" +CURL_REDIRECT_POLICY_LOG="$TEST_ROOT/curl-redirect-policy.log" mkdir -p "$FAKE_BIN" : > "$UUIDGEN_LOG" +: > "$CURL_REDIRECT_POLICY_LOG" cat > "$FAKE_BIN/uuidgen" <<'EOF' #!/usr/bin/env bash @@ -23,14 +25,45 @@ EOF cat > "$FAKE_BIN/curl" <<'EOF' #!/usr/bin/env bash +follow_redirects=false +proto_redir="" +payload="" +method="GET" + while (($# > 0)); do - if [[ "$1" == "-d" ]]; then - printf '%s\n' "$2" > "$CURL_PAYLOAD_FILE" - exit 0 - fi + case "$1" in + -L|--location) + follow_redirects=true + ;; + --proto-redir) + shift + proto_redir="$1" + ;; + -d|--data) + shift + payload="$1" + method="POST" + ;; + -X|--request) + shift + method="$1" + ;; + esac shift done -exit 1 + +if [[ -z "$payload" ]]; then + exit 1 +fi +printf '%s\n' "$payload" > "$CURL_PAYLOAD_FILE" + +if [[ "${CURL_REDIRECT_STATUS:-}" =~ ^30(7|8)$ && "${CURL_REDIRECT_URL:-}" == http://* ]]; then + printf '%s|%s|%s|%s\n' "$CURL_REDIRECT_STATUS" "$follow_redirects" "$proto_redir" "$method" >> "$CURL_REDIRECT_POLICY_LOG" + if [[ "$follow_redirects" == "true" && "$proto_redir" != "=https" ]]; then + printf 'followed insecure redirect\n' >> "$CURL_REDIRECT_POLICY_LOG" + fi + exit 1 +fi EOF cat > "$FAKE_BIN/yarn" <<'EOF' @@ -60,6 +93,9 @@ run_entrypoint() { UUIDGEN_LOG="$UUIDGEN_LOG" \ UUIDGEN_SHOULD_FAIL="false" \ CURL_PAYLOAD_FILE="$CURL_PAYLOAD_FILE" \ + CURL_REDIRECT_POLICY_LOG="$CURL_REDIRECT_POLICY_LOG" \ + CURL_REDIRECT_STATUS="" \ + CURL_REDIRECT_URL="" \ RESULT_FILE="$result_file" \ DATA_CACHE_DIR="$data_dir" \ DATABASE_URL="postgresql://test" \ @@ -89,7 +125,7 @@ supplied_data="$TEST_ROOT/supplied-data" supplied_result="$TEST_ROOT/supplied-result" supplied_id=$'supplied"install\\id\nsecond-line' mkdir -p "$supplied_data" -run_entrypoint "$supplied_data" "$supplied_result" SOURCEBOT_INSTALL_ID="$supplied_id" SOURCEBOT_TELEMETRY_DISABLED="false" POSTHOG_PAPIK="test-project-key" +run_entrypoint "$supplied_data" "$supplied_result" SOURCEBOT_INSTALL_ID="$supplied_id" SOURCEBOT_TELEMETRY_DISABLED="false" POSTHOG_PAPIK="test-project-key" CURL_REDIRECT_STATUS="307" CURL_REDIRECT_URL="http://insecure.example/capture/" assert_equals "uses the supplied install ID on first boot" "$(<"$supplied_result")" "$supplied_id" assert_equals "persists the supplied install ID as valid JSON" "$(jq -r '.install_id' "$supplied_data/.installedv3")" "$supplied_id" assert_equals "does not generate an ID when one is supplied" "$(wc -l < "$UUIDGEN_LOG" | tr -d ' ')" "0" @@ -99,12 +135,13 @@ if ! jq -e --arg expected "$supplied_id" \ echo "FAIL: install telemetry payload did not safely encode the supplied install ID" exit 1 fi +assert_equals "blocks an HTTP 307 redirect without changing the POST method" "$(sed -n '1p' "$CURL_REDIRECT_POLICY_LOG")" "307|true|=https|POST" # Exercise the next-boot read and upgrade telemetry paths with the same escaped ID. jq -n --arg install_id "$supplied_id" \ '{version: "previous-version", install_id: $install_id}' > "$supplied_data/.installedv3" supplied_restart_result="$TEST_ROOT/supplied-restart-result" -run_entrypoint "$supplied_data" "$supplied_restart_result" SOURCEBOT_INSTALL_ID="conflicting-install-id" SOURCEBOT_TELEMETRY_DISABLED="false" POSTHOG_PAPIK="test-project-key" +run_entrypoint "$supplied_data" "$supplied_restart_result" SOURCEBOT_INSTALL_ID="conflicting-install-id" SOURCEBOT_TELEMETRY_DISABLED="false" POSTHOG_PAPIK="test-project-key" CURL_REDIRECT_STATUS="308" CURL_REDIRECT_URL="http://insecure.example/capture/" assert_equals "reads the escaped install ID on the next boot" "$(<"$supplied_restart_result")" "$supplied_id" if ! jq -e --arg expected "$supplied_id" \ '.event == "upgrade" and .distinct_id == $expected and .api_key == "test-project-key"' \ @@ -112,6 +149,8 @@ if ! jq -e --arg expected "$supplied_id" \ echo "FAIL: upgrade telemetry payload did not safely encode the persisted install ID" exit 1 fi +assert_equals "blocks an HTTP 308 redirect without changing the POST method" "$(sed -n '2p' "$CURL_REDIRECT_POLICY_LOG")" "308|true|=https|POST" +assert_equals "never follows an insecure telemetry redirect" "$(wc -l < "$CURL_REDIRECT_POLICY_LOG" | tr -d ' ')" "2" generated_data="$TEST_ROOT/generated-data" generated_result="$TEST_ROOT/generated-result" diff --git a/entrypoint.sh b/entrypoint.sh index 63e5d3dbd..22ba17e19 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -160,7 +160,7 @@ if [ ! -f "$FIRST_RUN_FILE" ]; then --arg sourcebot_version "$SOURCEBOT_VERSION" \ '{api_key: $api_key, event: "install", distinct_id: $distinct_id, properties: {sourcebot_version: $sourcebot_version}}') - if ! ( curl -L --output /dev/null --silent --fail --header "Content-Type: application/json" -d "$INSTALL_EVENT_PAYLOAD" https://us.i.posthog.com/capture/ ) then + if ! ( curl -L --proto-redir '=https' --output /dev/null --silent --fail --header "Content-Type: application/json" -d "$INSTALL_EVENT_PAYLOAD" https://us.i.posthog.com/capture/ ) then echo -e "\e[33m[Warning] Failed to send install event.\e[0m" fi fi @@ -181,7 +181,7 @@ else --arg to_version "$SOURCEBOT_VERSION" \ '{api_key: $api_key, event: "upgrade", distinct_id: $distinct_id, properties: {from_version: $from_version, to_version: $to_version}}') - if ! ( curl -L --output /dev/null --silent --fail --header "Content-Type: application/json" -d "$UPGRADE_EVENT_PAYLOAD" https://us.i.posthog.com/capture/ ) then + if ! ( curl -L --proto-redir '=https' --output /dev/null --silent --fail --header "Content-Type: application/json" -d "$UPGRADE_EVENT_PAYLOAD" https://us.i.posthog.com/capture/ ) then echo -e "\e[33m[Warning] Failed to send upgrade event.\e[0m" fi fi