{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/18840","labels_url":"https://api.github.com/repos/docker/docker/issues/18840/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/18840/comments","events_url":"https://api.github.com/repos/docker/docker/issues/18840/events","html_url":"https://github.com/docker/docker/pull/18840","id":123389755,"number":18840,"title":"Send push information to trust code out-of-band","user":{"login":"aaronlehmann","id":10601430,"avatar_url":"https://avatars.githubusercontent.com/u/10601430?v=3","gravatar_id":"","url":"https://api.github.com/users/aaronlehmann","html_url":"https://github.com/aaronlehmann","followers_url":"https://api.github.com/users/aaronlehmann/followers","following_url":"https://api.github.com/users/aaronlehmann/following{/other_user}","gists_url":"https://api.github.com/users/aaronlehmann/gists{/gist_id}","starred_url":"https://api.github.com/users/aaronlehmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaronlehmann/subscriptions","organizations_url":"https://api.github.com/users/aaronlehmann/orgs","repos_url":"https://api.github.com/users/aaronlehmann/repos","events_url":"https://api.github.com/users/aaronlehmann/events{/privacy}","received_events_url":"https://api.github.com/users/aaronlehmann/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/group/security","name":"group/security","color":"F6FBFF"},{"url":"https://api.github.com/repos/docker/docker/labels/status/2-code-review","name":"status/2-code-review","color":"fad8c7"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/docker/docker/milestones/44","html_url":"https://github.com/docker/docker/milestones/1.10.0","labels_url":"https://api.github.com/repos/docker/docker/milestones/44/labels","id":1351533,"number":44,"title":"1.10.0","description":"Code freeze / feature freeze January 14th 2016\r\nPlanned release: February 4th, 2016\r\nhttps://github.com/docker/docker/wiki","creator":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"open_issues":37,"closed_issues":118,"state":"open","created_at":"2015-10-12T18:21:55Z","updated_at":"2016-01-09T00:54:48Z","due_on":"2016-01-13T23:00:00Z","closed_at":null},"comments":10,"created_at":"2015-12-22T00:56:01Z","updated_at":"2016-01-09T00:56:55Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/18840","html_url":"https://github.com/docker/docker/pull/18840","diff_url":"https://github.com/docker/docker/pull/18840.diff","patch_url":"https://github.com/docker/docker/pull/18840.patch"},"body":"The trust code used to parse the console output of `docker push` to\r\nextract the digest, tag, and size information and determine what to\r\nsign. This is fragile and might give an attacker control over what gets\r\nsigned if the attacker can find a way to influence what gets printed as\r\npart of the push output.\r\n\r\nThis commit sends the push metadata out-of-band. It introduces an `Aux`\r\nfield in JSONMessage that can carry application-specific data alongside\r\nprogress updates. Instead of parsing formatted output, the client looks\r\nin this field to get the digest, size, and tag from the push.\r\n\r\ncc @diogomonica @dmcgowan"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/170173268","html_url":"https://github.com/docker/docker/pull/18840#issuecomment-170173268","issue_url":"https://api.github.com/repos/docker/docker/issues/18840","id":170173268,"user":{"login":"crosbymichael","id":749551,"avatar_url":"https://avatars.githubusercontent.com/u/749551?v=3","gravatar_id":"","url":"https://api.github.com/users/crosbymichael","html_url":"https://github.com/crosbymichael","followers_url":"https://api.github.com/users/crosbymichael/followers","following_url":"https://api.github.com/users/crosbymichael/following{/other_user}","gists_url":"https://api.github.com/users/crosbymichael/gists{/gist_id}","starred_url":"https://api.github.com/users/crosbymichael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crosbymichael/subscriptions","organizations_url":"https://api.github.com/users/crosbymichael/orgs","repos_url":"https://api.github.com/users/crosbymichael/repos","events_url":"https://api.github.com/users/crosbymichael/events{/privacy}","received_events_url":"https://api.github.com/users/crosbymichael/received_events","type":"User","site_admin":false},"created_at":"2016-01-09T00:56:54Z","updated_at":"2016-01-09T00:56:54Z","body":"LGTM"}}