{"action":"created","issue":{"url":"https://api.github.com/repos/JuliaLang/julia/issues/17958","repository_url":"https://api.github.com/repos/JuliaLang/julia","labels_url":"https://api.github.com/repos/JuliaLang/julia/issues/17958/labels{/name}","comments_url":"https://api.github.com/repos/JuliaLang/julia/issues/17958/comments","events_url":"https://api.github.com/repos/JuliaLang/julia/issues/17958/events","html_url":"https://github.com/JuliaLang/julia/issues/17958","id":170565112,"number":17958,"title":"Check TLS certificates on downloads","user":{"login":"DemiMarie","id":6395399,"avatar_url":"https://avatars.githubusercontent.com/u/6395399?v=3","gravatar_id":"","url":"https://api.github.com/users/DemiMarie","html_url":"https://github.com/DemiMarie","followers_url":"https://api.github.com/users/DemiMarie/followers","following_url":"https://api.github.com/users/DemiMarie/following{/other_user}","gists_url":"https://api.github.com/users/DemiMarie/gists{/gist_id}","starred_url":"https://api.github.com/users/DemiMarie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DemiMarie/subscriptions","organizations_url":"https://api.github.com/users/DemiMarie/orgs","repos_url":"https://api.github.com/users/DemiMarie/repos","events_url":"https://api.github.com/users/DemiMarie/events{/privacy}","received_events_url":"https://api.github.com/users/DemiMarie/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/JuliaLang/julia/labels/build","name":"build","color":"444444"},{"url":"https://api.github.com/repos/JuliaLang/julia/labels/up%20for%20grabs","name":"up for grabs","color":"0b02e1"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":36,"created_at":"2016-08-11T03:44:51Z","updated_at":"2016-10-14T03:05:48Z","closed_at":null,"body":"Julia currently does not check TLS certificates on downloads.  It should.  Perhaps this is not now exploitable, but it is still good practice, and it is exploitable on systems where `sha512sum` and `shasum` are both missing."},"comment":{"url":"https://api.github.com/repos/JuliaLang/julia/issues/comments/253698346","html_url":"https://github.com/JuliaLang/julia/issues/17958#issuecomment-253698346","issue_url":"https://api.github.com/repos/JuliaLang/julia/issues/17958","id":253698346,"user":{"login":"tkelman","id":5934628,"avatar_url":"https://avatars.githubusercontent.com/u/5934628?v=3","gravatar_id":"","url":"https://api.github.com/users/tkelman","html_url":"https://github.com/tkelman","followers_url":"https://api.github.com/users/tkelman/followers","following_url":"https://api.github.com/users/tkelman/following{/other_user}","gists_url":"https://api.github.com/users/tkelman/gists{/gist_id}","starred_url":"https://api.github.com/users/tkelman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tkelman/subscriptions","organizations_url":"https://api.github.com/users/tkelman/orgs","repos_url":"https://api.github.com/users/tkelman/repos","events_url":"https://api.github.com/users/tkelman/events{/privacy}","received_events_url":"https://api.github.com/users/tkelman/received_events","type":"User","site_admin":false},"created_at":"2016-10-14T03:05:48Z","updated_at":"2016-10-14T03:05:48Z","body":"Actually centos 5 does have sha512sum in its coreutils, it doesn't always have `which` though so the checking that jlchecksum does isn't quite robust enough. It was msys that didn't have either shasum or sha512sum, and that's still needed to build with msvc at the moment. If we use a C implementation then we need it to be portable to all platforms and compilers, which is a fair amount of work. The implementation I linked above only works in a posix environment."}}
{"actor":{"display_login":"tkelman"}}