vuln-fix: Use HTTPS instead of HTTP to resolve dependencies

This fixes a security vulnerability in this project where the `build.gradle`
files were configuring Gradle to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: OpenRewrite

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#9


Co-authored-by: Moderne <[email protected]>

Author: JLLeitschuh

build.gradle

@@ -4,9 +4,9 @@ buildscript {
 
     repositories {
         if (project['CERN_VM']) {
-            maven { url 'http://artifactory.cern.ch/ds-jcenter' }
-            maven { url 'http://artifactory.cern.ch/development' }
-            maven { url 'http://artifactory.cern.ch/gradle-plugins' }
+            maven { url 'https://artifactory.cern.ch/ds-jcenter' }
+            maven { url 'https://artifactory.cern.ch/development' }
+            maven { url 'https://artifactory.cern.ch/gradle-plugins' }
         } else {
             gradlePluginPortal()
         }
@@ -29,8 +29,8 @@ sourceCompatibility = JavaVersion.VERSION_1_8
 
 repositories {
     if (project['CERN_VM']) {
-        maven { url 'http://artifactory.cern.ch/ds-jcenter' }
-        maven { url 'http://artifactory.cern.ch/development' }
+        maven { url 'https://artifactory.cern.ch/ds-jcenter' }
+        maven { url 'https://artifactory.cern.ch/development' }
     } else {
         mavenCentral()
     }
@@ -130,4 +130,4 @@ if (!project['CERN_VM']) {
 if (project['DEPLOYMENT']) {
     println 'Applying deployment scripts'
     apply from: 'https://raw.githubusercontent.com/ossgang/gradle-scripts/master/deployment/deploy-to-maven-central.gradle'
-}
+}