static secureGitUrl(ref, hash, reporter) {
    return (0, (_asyncToGenerator2 || _load_asyncToGenerator()).default)(function* () {
      if ((0, (_gitRefResolver || _load_gitRefResolver()).isCommitSha)(hash)) {
        // this is cryptographically secure
        return ref;
      }

      if (ref.protocol === 'git:') {
        const secureUrl = Git.replaceProtocol(ref, 'https:');
        if (yield Git.repoExists(secureUrl)) {
          return secureUrl;
        } else {
          reporter.warn(reporter.lang('downloadGitWithoutCommit', ref.repository));
          return ref;
        }
      }

      if (ref.protocol === 'http:') {
        const secureRef = Git.replaceProtocol(ref, 'https:');
        if (yield Git.repoExists(secureRef)) {
          return secureRef;
        } else {
          reporter.warn(reporter.lang('downloadHTTPWithoutCommit', ref.repository));
          return ref;
        }
      }

      return ref;
    })();
  }
Attempt to upgrade insecure protocols to secure protocol