Having built proxies many times before, I felt it is time to make a package. Forked from ASP.NET labs, it has been heavily modified with a different API, to facilitate a wider variety of proxying scenarios (i.e. routing based on a JWT claim) and interception of the proxy requests / responses for customization of headers and (optionally) request / response bodies. It also uses HttpClientFactory internally that will mitigate against DNS caching issues making it suitable for microservice / container environments.
Let’s Encrypt has done loads of work over the past lustrum to prevent trouble like cross-signing, issuing the successor certificates, and more.
The problem is that people like you and me have refrained from keeping their clients and servers up-to-date, so some security issues will occur. Hopefully they are limited to non-functioning communication and not leaking of data.
A while ago, I bumped into problems updating UltraVNC through Chocolatey.
It is similar to issues with other packages I have seen in the past: sha256 hash mismatches of which the reported mismatch changes over time, though the version stays the same.
This was tracked down to the actual file download site now needing a correct HTTP referer header. Likely this is to stop automated downloads, which kind of back-fires as ultimately you want to automate download and installation of things as much as possible.
Anyway: this is the [Archive.is] thread (which cannot be archived as Disqus hates archiving in the WayBack machine, and archive.is often fails with it too):
The recent update to 1.2300 fails for me with a file hash error. The install script has fe3d1135ae0e7b72394a6f3cc137282cb5e6382a55b5ceee72140d28f5ffe961, but the installer as downloaded, and verified via a separate download and hash check has 5A42A24BED5A39ACA44443916E5B2C4C259CE8E843E90FD07F7AB3D26CB237C8
IdealChain Graham Bloice•3 hours agoThis is because the download page has some “anti leeching” logic which checks the referer header and redirects to the homepage in case that check fails.Dear maintainer, please add the header “Referer: https://www.uvnc.com/” to the Install-ChocolateyPackage options!
Maurice Kevenaar IdealChain•2 hours ago IdealChain Thanks for this hint! I was still looking for a solution and now, thanks to you, I have one.A new version is being build and will be pushed up soon.
By now the error has changed; could it be that UltraVNC keeps releasing new Version 1.2300 with different hashes?
You have ultravnc v1.2240.0.20190403 installed. Version 1.2300 is available based on your source(s).
Progress: Downloading ultravnc 1.2300... 100%
ultravnc v1.2300 [Approved]
ultravnc package files upgrade completed. Performing other installation steps.
File appears to be downloaded already. Verifying with package checksum to determine if it needs to be redownloaded.
Error - hashes do not match. Actual value was '5168CD279B36141B4B5B21CAC449FD4738A0E7C281D19BE99B3EF22968D77B7E'.
Downloading ultravnc 64 bit
from 'https://www.uvnc.eu/download/1230/UltraVNC_1_2_30_X64_Setup.exe'
WARNING: C:\Users\jeroenp\AppData\Local\Temp\chocolatey\ultravnc\1.2300\index.php is of content type text/html; charset=utf-8
Download of index.php (-1 B) completed.
Error - hashes do not match. Actual value was 'D0030DCF7A58166CC96FF5F258D5E6F179F94F412456CD0CE7223561532A3AB2'.
ERROR: Checksum for 'C:\Users\jeroenp\AppData\Local\Temp\chocolatey\ultravnc\1.2300\index.php' did not meet 'fe3d1135ae0e7b72394a6f3cc137282cb5e6382a55b5ceee72140d28f5ffe961' for checksum type 'sha256'. Consider passing the actual checksums through with --checksum --checksum64 once you validate the checksums are appropriate. A less secure option is to pass --ignore-checksums if necessary.
The upgrade of ultravnc was NOT successful.
Error while running 'C:\ProgramData\chocolatey\lib\ultravnc\tools\chocolateyInstall.ps1'.
See log for details.
Convert the CIDR notation to individual IP addresses (as sendmail cannot handle CIDR),
This uses a combination of xargs with the sh trick to split the CIDR list into separate arguments, and prips (which prints the IP addresses for a CIDR); see:
The Wiert Corner - irregular stream of stuff 