{"action":"created","issue":{"url":"https://api.github.com/repos/jodersky/sbt-gpg/issues/5","repository_url":"https://api.github.com/repos/jodersky/sbt-gpg","labels_url":"https://api.github.com/repos/jodersky/sbt-gpg/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/jodersky/sbt-gpg/issues/5/comments","events_url":"https://api.github.com/repos/jodersky/sbt-gpg/issues/5/events","html_url":"https://github.com/jodersky/sbt-gpg/issues/5","id":348180772,"node_id":"MDU6SXNzdWUzNDgxODA3NzI=","number":5,"title":"Use password from credentials","user":{"login":"jroper","id":105833,"node_id":"MDQ6VXNlcjEwNTgzMw==","avatar_url":"https://avatars0.githubusercontent.com/u/105833?v=4","gravatar_id":"","url":"https://api.github.com/users/jroper","html_url":"https://github.com/jroper","followers_url":"https://api.github.com/users/jroper/followers","following_url":"https://api.github.com/users/jroper/following{/other_user}","gists_url":"https://api.github.com/users/jroper/gists{/gist_id}","starred_url":"https://api.github.com/users/jroper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jroper/subscriptions","organizations_url":"https://api.github.com/users/jroper/orgs","repos_url":"https://api.github.com/users/jroper/repos","events_url":"https://api.github.com/users/jroper/events{/privacy}","received_events_url":"https://api.github.com/users/jroper/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-08-07T06:12:46Z","updated_at":"2018-08-18T18:52:10Z","closed_at":null,"author_association":"NONE","body":"It would be nice if the sbt-gpg could use the password from the credentials file. It's been a while since I've played with this stuff directly, but the way to do this is probably to use the `--passphrase-fd 0` argument, which tells gpg to read the passphrase from standard in. Then when you run the command, you write the passphrase to the processes OutputStream and then close it."},"comment":{"url":"https://api.github.com/repos/jodersky/sbt-gpg/issues/comments/414079128","html_url":"https://github.com/jodersky/sbt-gpg/issues/5#issuecomment-414079128","issue_url":"https://api.github.com/repos/jodersky/sbt-gpg/issues/5","id":414079128,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNDA3OTEyOA==","user":{"login":"wsargent","id":71236,"node_id":"MDQ6VXNlcjcxMjM2","avatar_url":"https://avatars2.githubusercontent.com/u/71236?v=4","gravatar_id":"","url":"https://api.github.com/users/wsargent","html_url":"https://github.com/wsargent","followers_url":"https://api.github.com/users/wsargent/followers","following_url":"https://api.github.com/users/wsargent/following{/other_user}","gists_url":"https://api.github.com/users/wsargent/gists{/gist_id}","starred_url":"https://api.github.com/users/wsargent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wsargent/subscriptions","organizations_url":"https://api.github.com/users/wsargent/orgs","repos_url":"https://api.github.com/users/wsargent/repos","events_url":"https://api.github.com/users/wsargent/events{/privacy}","received_events_url":"https://api.github.com/users/wsargent/received_events","type":"User","site_admin":false},"created_at":"2018-08-18T18:52:10Z","updated_at":"2018-08-18T18:52:10Z","author_association":"NONE","body":"> This is one of two reasons why you should never do SSL termination in the JVM when writing an http server. Ever. Terminate SSL in an external proxy such as nginx. (the second major reason is performance, btw)\r\n\r\nIt's a bit more complex than that.  External proxies like nginx do not take any special measures to protect the security key against exposure, and since external proxies are written in C, they are exposed to the openssl library and unsafe memory access, leading to things like [heartbleed](https://blog.cloudflare.com/answering-the-critical-question-can-you-get-private-ssl-keys-using-heartbleed/), which Java is thankfully not prone to.  \r\n\r\nIdeally, web servers should not have [access to private keys at all](https://plus.google.com/106751305389299207737/posts/WM4i4Rqxs5n), and the private keys should be using PKCS#11 to talk to an HSM module like YubikeyHSM or [CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/ssl-offload.html).\r\n\r\n> (the second major reason is performance, btw)\r\n\r\nThis is much less of an issue now that AES intrinsics are enabled and the underlying engine issues have been worked on.   Performance is around 36% slower in 1.9+181 according to [Istio](https://medium.com/jayanthg/transparently-securing-kafka-istio-style-with-up-to-300-higher-performance-than-native-tls-in-aa95731b5d40)."}}
{"actor":{"display_login":"wsargent"}}