fix(download): use HTTPS for gpt4all.io metadata and model fallback (#3682) - #3688
Open
Anai-Guo wants to merge 1 commit into
Open
fix(download): use HTTPS for gpt4all.io metadata and model fallback (#3682)#3688Anai-Guo wants to merge 1 commit into
Anai-Guo wants to merge 1 commit into
Conversation
Anai-Guo
force-pushed
the
fix-download-https
branch
from
July 7, 2026 22:08
4abdff3 to
6ee25f3
Compare
…omic-ai#3682) release.json, latestnews.md, and the model-download fallback were fetched over plaintext http://gpt4all.io. Because the expected model hash comes from release.json over the same channel, a MITM could substitute both the hash and the model file and still pass verification. Switch the three URLs to https://. The endpoints already serve the same content over TLS (301 -> 200), so there is no behavior change for legitimate clients; Qt QNetworkAccessManager verifies certificates by default. Signed-off-by: Anai-Guo <antai12232931@anaiguo.com>
Anai-Guo
force-pushed
the
fix-download-https
branch
from
July 7, 2026 22:17
6ee25f3 to
991d555
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #3682.
gpt4all-chat/src/download.cppfetched three resources over plaintexthttp://gpt4all.io:release.json(release metadata)latestnews.md/models/gguf/<file>)Model integrity is checked against a hash, but that expected hash is itself pulled from
release.jsonover the same plaintext channel. A MITM on the path can therefore substitute both the hash and the model file, and verification still passes — a supply-chain risk.Change
Switch the three URLs from
http://tohttps://. Nothing else is touched.Why this is safe
https://gpt4all.io/meta/release.jsonand.../latestnews.mdalready serve the same content over TLS (verified:301 → 200, identical payload), so there is no behavior change for legitimate clients.QNetworkAccessManagerperforms TLS certificate verification by default, so moving the initial hop to HTTPS closes the MITM window without any extra configuration.🤖 Generated with Claude Code