fix(security): download SteamCMD and MTA files over HTTPS (#5054)

* fix(security): download SteamCMD and MTA files over HTTPS

SteamCMD, the MTA server binaries and the MTA default resources were
downloaded over plain HTTP with hash checking disabled. Anyone able to
alter that traffic could swap in code that LinuxGSM later runs.

- Use HTTPS for the SteamCMD tarball, the MTA server tarball (download
  and build-check URL) and the MTA resources zip. The MTA URLs move to
  the multitheftauto.com hosts that MTA documents.
- When fn_fetch_file starts from an https:// URL, only allow HTTPS
  redirects, so a download cannot be downgraded to HTTP part way.

Neither Valve nor MTA publishes checksums or signatures for these
rolling "latest" files, so there is nothing trustworthy to pin yet.

Fixes #4954

* fix(mta): show linux.multitheftauto.com as the update source

lgsm/modules/command_install_resources_mta.sh

@@ -14,7 +14,7 @@ fn_install_resources() {
 	echo -e ""
 	echo -e "${bold}${lightyellow}Installing Default Resources${default}"
 	fn_messages_separator
-	fn_fetch_file "http://mirror.mtasa.com/mtasa/resources/mtasa-resources-latest.zip" "" "" "" "${tmpdir}" "mtasa-resources-latest.zip" "nochmodx" "norun" "noforce" "nohash"
+	fn_fetch_file "https://mirror.multitheftauto.com/mtasa/resources/mtasa-resources-latest.zip" "" "" "" "${tmpdir}" "mtasa-resources-latest.zip" "nochmodx" "norun" "noforce" "nohash"
 	fn_dl_extract "${tmpdir}" "mtasa-resources-latest.zip" "${resourcesdir}"
 	echo -e "Default Resources Installed."
 }

lgsm/modules/core_dl.sh

@@ -458,6 +458,9 @@ fn_fetch_file() {
 			# Trap will remove part downloaded files if canceled.
 			trap fn_fetch_trap INT
 			curlcmd=(curl --connect-timeout 3 --fail -L -o "${local_filedir}/${local_filename}" --retry 2 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.${randomint}.212 Safari/537.36")
+			if [[ "${fileurl}" == https://* ]]; then
+				curlcmd+=(--proto-redir "=https")
+			fi
 
 			# if is large file show progress, else be silent
 			local exitcode=""

lgsm/modules/core_steamcmd.sh

@@ -14,7 +14,7 @@ fn_install_steamcmd() {
 	if [ ! -d "${steamcmddir}" ]; then
 		mkdir -p "${steamcmddir}"
 	fi
-	fn_fetch_file "http://media.steampowered.com/client/steamcmd_linux.tar.gz" "" "" "" "${tmpdir}" "steamcmd_linux.tar.gz" "nochmodx" "norun" "noforce" "nohash"
+	fn_fetch_file "https://media.steampowered.com/client/steamcmd_linux.tar.gz" "" "" "" "${tmpdir}" "steamcmd_linux.tar.gz" "nochmodx" "norun" "noforce" "nohash"
 	fn_dl_extract "${tmpdir}" "steamcmd_linux.tar.gz" "${steamcmddir}"
 	chmod +x "${steamcmddir}/steamcmd.sh"
 }

lgsm/modules/update_mta.sh

@@ -9,7 +9,7 @@ moduleselfname="$(basename "$(readlink -f "${BASH_SOURCE[0]}")")"
 
 fn_update_dl() {
 	# Download and extract files to tmpdir.
-	fn_fetch_file "http://linux.mtasa.com/dl/multitheftauto_linux_x64.tar.gz" "" "" "" "${tmpdir}" "multitheftauto_linux_x64.tar.gz" "nochmodx" "norun" "force" "nohash"
+	fn_fetch_file "https://linux.multitheftauto.com/dl/multitheftauto_linux_x64.tar.gz" "" "" "" "${tmpdir}" "multitheftauto_linux_x64.tar.gz" "nochmodx" "norun" "force" "nohash"
 	fn_dl_extract "${tmpdir}" "multitheftauto_linux_x64.tar.gz" "${serverfiles}" "multitheftauto_linux_x64"
 	fn_clear_tmp
 }
@@ -38,7 +38,7 @@ fn_update_remotebuild() {
 	apiurl="https://linux.multitheftauto.com/revision/latest.txt"
 	remotebuildresponse=$(curl -s "${apiurl}")
 	remotebuildfilename="multitheftauto_linux_x64.tar.gz"
-	remotebuildurl="http://linux.mtasa.com/dl/multitheftauto_linux_x64.tar.gz"
+	remotebuildurl="https://linux.multitheftauto.com/dl/multitheftauto_linux_x64.tar.gz"
 	remotebuild="${remotebuildresponse}"
 	if [ "${firstcommandname}" != "INSTALL" ]; then
 		fn_print_dots "Checking remote build: ${remotelocation}"
@@ -158,7 +158,7 @@ fn_update_compare() {
 }
 
 # The location where the builds are checked and downloaded.
-remotelocation="linux.mtasa.com"
+remotelocation="linux.multitheftauto.com"
 
 if [ "${firstcommandname}" == "INSTALL" ]; then
 	fn_update_remotebuild