Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security: Enable SSL Signature Checks #58

Merged
merged 1 commit into from Jan 29, 2024

Conversation

steelhead31
Copy link
Contributor

Remove disabled signature checks for download of Jenkins slave.jar from HTTPs served jenkins server.

Fixes adoptium/infrastructure#3342

Identified in Trail Of Bits Security Audit: TOB-9

Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A block has been put on this Pull Request as this repository is temporarily under a code freeze due to an ongoing release cycle.

If this pull request needs to be merged during the release cycle then please comment /merge and a PMC member will be able to remove the block.

If the code freeze is over you can remove this block by commenting /thaw.

Copy link
Contributor

@andrew-m-leonard andrew-m-leonard left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good spot

@steelhead31
Copy link
Contributor Author

/thaw

Copy link

Sorry @steelhead31, the code freeze is still in place.

@steelhead31
Copy link
Contributor Author

/thaw

@github-actions github-actions bot dismissed their stale review January 29, 2024 13:56

Pull Request unblocked - code freeze is over.

@steelhead31 steelhead31 merged commit 2c90dad into adoptium:master Jan 29, 2024
3 checks passed
@steelhead31 steelhead31 self-assigned this Jan 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

Insecure download using wget command
3 participants