refactor(x/upgrade): configure go-getter (#18470)

x/upgrade/CHANGELOG.md

@@ -25,6 +25,10 @@ Ref: https://keepachangelog.com/en/1.0.0/
 
 ## [Unreleased]
 
+### Improvements
+
+* [#18470](https://github.com/cosmos/cosmos-sdk/pull/18470) Improve go-getter settings.
+
 ### State Machine Breaking
 
 * (x/upgrade) [#16244](https://github.com/cosmos/cosmos-sdk/pull/16244) Upgrade module no longer stores the app version but gets and sets the app version stored in the `ParamStore` of baseapp.

x/upgrade/go.mod

@@ -18,6 +18,7 @@ require (
 	github.com/cosmos/gogoproto v1.4.11
 	github.com/golang/protobuf v1.5.3
 	github.com/grpc-ecosystem/grpc-gateway v1.16.0
+	github.com/hashicorp/go-cleanhttp v0.5.2
 	github.com/hashicorp/go-getter v1.7.3
 	github.com/hashicorp/go-metrics v0.5.2
 	github.com/spf13/cast v1.5.1
@@ -101,7 +102,6 @@ require (
 	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.5.0 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-plugin v1.5.2 // indirect

x/upgrade/plan/downloader.go

@@ -1,13 +1,15 @@
 package plan
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	neturl "net/url"
 	"os"
 	"path/filepath"
 	"strings"
 
+	"github.com/hashicorp/go-cleanhttp"
 	"github.com/hashicorp/go-getter"
 )
 
@@ -24,8 +26,9 @@ import (
 // NOTE: This functions does not check the provided url for validity.
 func DownloadUpgrade(dstRoot, url, daemonName string) error {
 	target := filepath.Join(dstRoot, "bin", daemonName)
+
 	// First try to download it as a single file. If there's no error, it's okay and we're done.
-	if err := getter.GetFile(target, url); err != nil {
+	if err := getFile(url, target); err != nil {
 		// If it was a checksum error, no need to try as directory.
 		if _, ok := err.(*getter.ChecksumError); ok {
 			return err
@@ -109,7 +112,8 @@ func DownloadURL(url string) (string, error) {
 	}
 	defer os.RemoveAll(tempDir)
 	tempFile := filepath.Join(tempDir, "content")
-	if err = getter.GetFile(tempFile, url); err != nil {
+
+	if err := getFile(url, tempFile); err != nil {
 		return "", fmt.Errorf("could not download url \"%s\": %w", url, err)
 	}
 	tempFileBz, rerr := os.ReadFile(tempFile)
@@ -136,3 +140,27 @@ func ValidateURL(urlStr string, mustChecksum bool) error {
 
 	return nil
 }
+
+// getFile downloads the given url into the provided directory.
+func getFile(url, dst string) error {
+	httpGetter := &getter.HttpGetter{
+		Client:                cleanhttp.DefaultClient(),
+		XTerraformGetDisabled: true,
+	}
+
+	goGetterGetters := getter.Getters
+	goGetterGetters["http"] = httpGetter
+	goGetterGetters["https"] = httpGetter
+
+	// https://github.com/hashicorp/go-getter#security-options
+	getterClient := &getter.Client{
+		Ctx:             context.Background(),
+		DisableSymlinks: true,
+		Src:             url,
+		Dst:             dst,
+		Pwd:             dst,
+		Getters:         goGetterGetters,
+	}
+
+	return getterClient.Get()
+}