crash-reporter: use HTTPS when sending crashes

crash_sender

Index: crash_sender
diff --git a/crash_sender b/crash_sender
index 2e56dec580d20a66b6210d5bef37b1bd39b86e5a..cd888869f7dac0679ab81c154fc275729c74fe5c 100644
--- a/crash_sender
+++ b/crash_sender
@@ -46,7 +46,7 @@ MOCK_CRASH_SENDING="/tmp/mock-crash-sending"
 PAUSE_CRASH_SENDING="/var/lib/crash_sender_paused"
 
 # URL to send official build crash reports to.
-REPORT_UPLOAD_PROD_URL="http://clients2.google.com/cr/report"
+REPORT_UPLOAD_PROD_URL="https://clients2.google.com/cr/report"
 
 # File whose existence implies we're running and not to start again.
 RUN_FILE="/var/run/crash_sender.pid"
@@ -61,6 +61,10 @@ TAG="$(basename $0)[$$]"
 # hours.
 TIMESTAMPS_DIR="/var/lib/crash_sender"
 
+# Path to a directory of restricted certificates which includes
+# a certificate for ${RESPORT_UPLOAD_PROD_URL}.

[petkov, 2010/11/18 22:21:48]

typo: RESPORT

+RESTRICTED_CERTIFICATES_PATH="/usr/share/update_engine/ca-certificates"
+
 # Temp directory for this process.
 TMP_DIR=""
 
@@ -254,6 +258,7 @@ send_crash() {
 
   set +e
   curl "${url}" \
+    --capath "${RESTRICTED_CERTIFICATES_PATH}" \

[petkov, 2010/11/18 22:21:48]

you probably also want --ciphers HIGH (assuming curl uses openssl on the target)
-- there was a security request for this for update engine.

     -F "prod=${CHROMEOS_PRODUCT}" \
     -F "ver=${chromeos_version}" \
     -F "upload_file_${kind}=@${report_payload}" \
@@ -382,7 +387,8 @@ main() {
 
   check_not_already_running
 
-  for dependency in "${FIND}" "${METRICS_CLIENT}"; do
+  for dependency in "${FIND}" "${METRICS_CLIENT}" \
+                    "${RESTRICTED_CERTIFICATES_PATH}"; do
     if [ ! -x "${dependency}" ]; then
       lecho "Fatal: Crash sending disabled: ${dependency} not found."
       exit 1