[JBoss JIRA] (JBIDE-24642) Please include sha256 checksums in announcements
by Jesper Skov (JIRA)
[ https://issues.jboss.org/browse/JBIDE-24642?page=com.atlassian.jira.plugi... ]
Jesper Skov commented on JBIDE-24642:
-------------------------------------
Awesome!
I look forward to using it with the next release.
Thanks!
> Please include sha256 checksums in announcements
> ------------------------------------------------
>
> Key: JBIDE-24642
> URL: https://issues.jboss.org/browse/JBIDE-24642
> Project: Tools (JBoss Tools)
> Issue Type: Feature Request
> Components: build, website
> Reporter: Jesper Skov
> Assignee: Nick Boldt
> Fix For: 4.5.0.Final
>
>
> I would like to be able to verify checksums on downloaded JBoss artifacts - both EAP and eclipse-related binaries.
> Or even better, verify a signature.
> Today, when I want to use a JBossTools release, I would download
> http://download.jboss.org/jbosstools/static/oxygen/development/updates/co...
> And my only opportunity to verify the file is by downloading the sha256 file that lies next to it:
> http://download.jboss.org/jbosstools/static/oxygen/development/updates/co...
> If a hacker manages to replace the updatesite archive with compromised files, I assume they will have the brains to also update the checksum file next to it.
> So the current checksum can really only be used to verify the integrity of the downloaded file.
> Not that its contents is untampered.
> If the jar-files in the archive were signed, it would be less of an issue...
> Signed artifacts would be best. But would probably take some effort to put in place.
> A simpler remedy would be to include the checksums in the announcement. This would give an additional factor of security for those who care about that.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 8 months
[JBoss JIRA] (ERT-517) Add basic security for running images [EBZ#519581]
by Jeff Johnston (JIRA)
[ https://issues.jboss.org/browse/ERT-517?page=com.atlassian.jira.plugin.sy... ]
Jeff Johnston resolved ERT-517.
-------------------------------
Resolution: Done
> Add basic security for running images [EBZ#519581]
> --------------------------------------------------
>
> Key: ERT-517
> URL: https://issues.jboss.org/browse/ERT-517
> Project: Eclipse Release Train
> Issue Type: Task
> Components: Linux Tools
> Reporter: Friendly Jira Robot
> Assignee: Jeff Johnston
> Labels: 6.1.0, Docker, bzira
> Fix For: Oxygen.1 (4.7)
>
>
> In a blog by Daniel Walsh, it was recommended that Containers be run with readonly root fs (--readonly). That said, to run most Containers successfully, this option also required accessing /run and /tmp in tmpfs (--tmpfs /run --tmpfs /tmp).
> A basic security option should be added to the Run Image Wizard to support:
> --readonly --tmpfs /run --tmpfs /tmp
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 8 months