Cake: Enable security via HTTPS

[matkoch]

There are several security flaws across all cake products when files are downloaded without using HTTPS protocol. Most severe issue is the download of _packages.config_ because there is no time between downloading and continuing code execution.

[devlead]

Duplicate of cake-build/website#40

We're in the middle of migration to new infrastructure, where both SSL and HSTS will be enabled.

[matkoch]

This is NOT a duplicate! It's not about the website after all. It's about ensuring that in fact the correct bootstrapper is downloaded and no malicious code is executed.

[gep13]

@matkoch it was marked as a duplicate due to the fact that you couldn't have one, without the other. I believe that all necessary changes in this regard have now been made.

[matkoch]

@gep13 Doesn't seem so 😃 To be correct, the other issue was closed _without_ fixing the issue I've described here.

[gep13]

@matkoch yes, it was, and you will notice as well that it was immediately opened again.

[matkoch]

@gep13 as far as I remember it was only re-opened after I've pointed out the actual problem again 🤔

https://gitter.im/cake-build/cake?at=59873dd876a757f8087d0c6f

Anyways, great that you've fixed it.

[matkoch]

Still no public announcement on that?

[matkoch]

@gep13 @devlead ?

[devlead]

@matkoch post is merged and will be out later today

[matkoch]

@devlead are you going to do anything else? Not everyone follows up on blog posts and twitter...

[gep13]

@matkoch what else would you suggest?

[devlead]

I'm going to have a beer and that's about it.

[matkoch]

@devlead enjoy your beer 👍
@gep13 following up here: https://github.com/cake-build/website/pull/398#issuecomment-325134731