{"action":"created","issue":{"url":"https://api.github.com/repos/jenkinsci/jenkins/issues/3356","repository_url":"https://api.github.com/repos/jenkinsci/jenkins","labels_url":"https://api.github.com/repos/jenkinsci/jenkins/issues/3356/labels{/name}","comments_url":"https://api.github.com/repos/jenkinsci/jenkins/issues/3356/comments","events_url":"https://api.github.com/repos/jenkinsci/jenkins/issues/3356/events","html_url":"https://github.com/jenkinsci/jenkins/pull/3356","id":306154727,"node_id":"MDExOlB1bGxSZXF1ZXN0MTc1Njk5NDk0","number":3356,"title":"Add support for SHA-256/512 in update site metadata","user":{"login":"daniel-beck","id":1831569,"node_id":"MDQ6VXNlcjE4MzE1Njk=","avatar_url":"https://avatars3.githubusercontent.com/u/1831569?v=4","gravatar_id":"","url":"https://api.github.com/users/daniel-beck","html_url":"https://github.com/daniel-beck","followers_url":"https://api.github.com/users/daniel-beck/followers","following_url":"https://api.github.com/users/daniel-beck/following{/other_user}","gists_url":"https://api.github.com/users/daniel-beck/gists{/gist_id}","starred_url":"https://api.github.com/users/daniel-beck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daniel-beck/subscriptions","organizations_url":"https://api.github.com/users/daniel-beck/orgs","repos_url":"https://api.github.com/users/daniel-beck/repos","events_url":"https://api.github.com/users/daniel-beck/events{/privacy}","received_events_url":"https://api.github.com/users/daniel-beck/received_events","type":"User","site_admin":false},"labels":[{"id":271563577,"node_id":"MDU6TGFiZWwyNzE1NjM1Nzc=","url":"https://api.github.com/repos/jenkinsci/jenkins/labels/ready-for-merge","name":"ready-for-merge","color":"009800","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2018-03-17T13:00:53Z","updated_at":"2018-06-26T14:11:41Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/jenkinsci/jenkins/pulls/3356","html_url":"https://github.com/jenkinsci/jenkins/pull/3356","diff_url":"https://github.com/jenkinsci/jenkins/pull/3356.diff","patch_url":"https://github.com/jenkinsci/jenkins/pull/3356.patch"},"body":"If the update site metadata provides SHA-512 or SHA-256 checksums, check those.\r\n\r\nThis is intended as a security hardening. SHA-1 isn't a good choice anymore.\r\n\r\nCompanion PR in infra: https://github.com/jenkins-infra/update-center2/pull/191. As Jenkins will continue to support update sites that only provide SHA-1 (for now, and with a warning), they could be merged independently, but probably should not be.\r\n\r\n### Proposed changelog entries\r\n\r\n* RFE: Check SHA-512 or SHA-256 checksums of update site metadata and core and plugin downloads if the update site provides them.\r\n\r\n### Submitter checklist\r\n\r\n- [n/a] JIRA issue is well described\r\n- [x] Changelog entry appropriate for the audience affected by the change (users or developer, depending on the change). [Examples](https://github.com/jenkins-infra/jenkins.io/blob/master/content/_data/changelogs/weekly.yml)\r\n      * Use the `Internal: ` prefix if the change has no user-visible impact (API, test frameworks, etc.)\r\n- [x] Appropriate autotests or explanation to why this change has no tests\r\n- [n/a] For dependency updates: links to external changelogs and, if possible, full diffs\r\n"},"comment":{"url":"https://api.github.com/repos/jenkinsci/jenkins/issues/comments/400323462","html_url":"https://github.com/jenkinsci/jenkins/pull/3356#issuecomment-400323462","issue_url":"https://api.github.com/repos/jenkinsci/jenkins/issues/3356","id":400323462,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMDMyMzQ2Mg==","user":{"login":"daniel-beck","id":1831569,"node_id":"MDQ6VXNlcjE4MzE1Njk=","avatar_url":"https://avatars3.githubusercontent.com/u/1831569?v=4","gravatar_id":"","url":"https://api.github.com/users/daniel-beck","html_url":"https://github.com/daniel-beck","followers_url":"https://api.github.com/users/daniel-beck/followers","following_url":"https://api.github.com/users/daniel-beck/following{/other_user}","gists_url":"https://api.github.com/users/daniel-beck/gists{/gist_id}","starred_url":"https://api.github.com/users/daniel-beck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daniel-beck/subscriptions","organizations_url":"https://api.github.com/users/daniel-beck/orgs","repos_url":"https://api.github.com/users/daniel-beck/repos","events_url":"https://api.github.com/users/daniel-beck/events{/privacy}","received_events_url":"https://api.github.com/users/daniel-beck/received_events","type":"User","site_admin":false},"created_at":"2018-06-26T14:11:41Z","updated_at":"2018-06-26T14:11:41Z","author_association":"MEMBER","body":"Un-onholding this, after releasing update-center2-2.0 and using it in https://github.com/jenkins-infra/crawler/pull/77 tools metadata include the additional checksums.\r\n\r\nHaven't attempted this PR build yet, but I expect this to resolve the problem from the previous comment."}}
{"actor":{"display_login":"daniel-beck"}}