You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@aurora.apache.org by "Bill Farner (JIRA)" <ji...@apache.org> on 2015/12/28 03:21:49 UTC

[jira] [Resolved] (AURORA-616) Consider using gradle-witness to verify dependencies

     [ https://issues.apache.org/jira/browse/AURORA-616?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Bill Farner resolved AURORA-616.
--------------------------------
    Resolution: Won't Fix

> Consider using gradle-witness to verify dependencies
> ----------------------------------------------------
>
>                 Key: AURORA-616
>                 URL: https://issues.apache.org/jira/browse/AURORA-616
>             Project: Aurora
>          Issue Type: Story
>          Components: Build, Scheduler, Security
>            Reporter: Bill Farner
>            Priority: Trivial
>              Labels: newbie
>
> gradle-witness \[1\] aims to provide insulation against MITM attacks via maven dependency downloads.  From the looks of things, it would require a pretty small amount of upfront work and upkeep to integrate this and prevent injection of rogue code.
> \[1\] https://github.com/whispersystems/gradle-witness



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)