Apk download url needs to be HTTPS

[valllllll2000]

We currently have a json rest api the app queries:
/deviceapprest
This service returns a json object with amongst other contains the url to download the apk using the DeviceApplication entity of the datastore. The url field is always http. When updating the android tools with Android 28, there is a new feature enabled by default which is to prohibit http calls. For now I have disabled that setting (due to the support url and device time) and also I am replacing http by https when downloading the apk but it would be nice to start using https for these urls as both urls work.
see: https://developer.android.com/training/articles/security-config#CleartextTrafficPermitted for more info

[stellanl]

Two approaches:

1. Change ApkRedirectServlet to modify the URL from the DeviceApplication table.
2. Change the (script?) code that inserts new URLs in DeviceApplication during deployment. We could also make a datascript that modifies all the old URLs.

[muloem]

I would vote for option 2, i.e. what is put in is what comes out. No surprises and having to always remember that there is somewhere that the URL gets modified.