aurora-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Bill Farner (JIRA)" <j...@apache.org>
Subject [jira] [Created] (AURORA-616) Consider using gradle-witness to verify dependencies
Date Tue, 29 Jul 2014 03:36:39 GMT
Bill Farner created AURORA-616:
----------------------------------

             Summary: Consider using gradle-witness to verify dependencies
                 Key: AURORA-616
                 URL: https://issues.apache.org/jira/browse/AURORA-616
             Project: Aurora
          Issue Type: Story
          Components: Build, Scheduler
            Reporter: Bill Farner
            Priority: Trivial


gradle-witness \[1\] aims to provide insulation against MITM attacks via maven dependency
downloads.  From the looks of things, it would require a pretty small amount of upfront work
and upkeep to integrate this and prevent injection of rogue code.

\[1\] https://github.com/whispersystems/gradle-witness



--
This message was sent by Atlassian JIRA
(v6.2#6252)

Mime
View raw message