docs: convert link from http to https in doc/release-process.md #14799

  86 | @@ -87,7 +87,7 @@ Ensure gitian-builder is up-to-date:
  87 |      pushd ./gitian-builder
  88 |      mkdir -p inputs
  89 |      wget -P inputs https://bitcoincore.org/cfields/osslsigncode-Backports-to-1.7.1.patch
  90 | -    wget -P inputs http://downloads.sourceforge.net/project/osslsigncode/osslsigncode/osslsigncode-1.7.1.tar.gz
  91 | +    wget -P inputs https://downloads.sourceforge.net/project/osslsigncode/osslsigncode/osslsigncode-1.7.1.tar.gz

practicalswift commented at 10:25 PM on November 25, 2018:

Should we confirm the checksums of osslsigncode-Backports-to-1.7.1.patch and osslsigncode-1.7.1.tar.gz too?

MarcoFalke commented at 4:47 PM on November 26, 2018:

If they are not checked, https isn't going to help either.

practicalswift commented at 5:03 PM on November 26, 2018:

Yes, ideally we should have both: checksumming to make sure we get the data we expect and TLS to avoid leaking our request to eavesdroppers (beyond leaking the hostname).