{"action":"created","issue":{"url":"https://api.github.com/repos/mesosphere/marathon/issues/1968","labels_url":"https://api.github.com/repos/mesosphere/marathon/issues/1968/labels{/name}","comments_url":"https://api.github.com/repos/mesosphere/marathon/issues/1968/comments","events_url":"https://api.github.com/repos/mesosphere/marathon/issues/1968/events","html_url":"https://github.com/mesosphere/marathon/issues/1968","id":99667117,"number":1968,"title":"Marathon Dockerfile insecure download","user":{"login":"amouat","id":246775,"avatar_url":"https://avatars.githubusercontent.com/u/246775?v=3","gravatar_id":"","url":"https://api.github.com/users/amouat","html_url":"https://github.com/amouat","followers_url":"https://api.github.com/users/amouat/followers","following_url":"https://api.github.com/users/amouat/following{/other_user}","gists_url":"https://api.github.com/users/amouat/gists{/gist_id}","starred_url":"https://api.github.com/users/amouat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amouat/subscriptions","organizations_url":"https://api.github.com/users/amouat/orgs","repos_url":"https://api.github.com/users/amouat/repos","events_url":"https://api.github.com/users/amouat/events{/privacy}","received_events_url":"https://api.github.com/users/amouat/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mesosphere/marathon/labels/packaging","name":"packaging","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/mesosphere/marathon/milestones/12","html_url":"https://github.com/mesosphere/marathon/milestones/Backlog","labels_url":"https://api.github.com/repos/mesosphere/marathon/milestones/12/labels","id":870039,"number":12,"title":"Backlog","description":"","creator":{"login":"ConnorDoyle","id":379372,"avatar_url":"https://avatars.githubusercontent.com/u/379372?v=3","gravatar_id":"","url":"https://api.github.com/users/ConnorDoyle","html_url":"https://github.com/ConnorDoyle","followers_url":"https://api.github.com/users/ConnorDoyle/followers","following_url":"https://api.github.com/users/ConnorDoyle/following{/other_user}","gists_url":"https://api.github.com/users/ConnorDoyle/gists{/gist_id}","starred_url":"https://api.github.com/users/ConnorDoyle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ConnorDoyle/subscriptions","organizations_url":"https://api.github.com/users/ConnorDoyle/orgs","repos_url":"https://api.github.com/users/ConnorDoyle/repos","events_url":"https://api.github.com/users/ConnorDoyle/events{/privacy}","received_events_url":"https://api.github.com/users/ConnorDoyle/received_events","type":"User","site_admin":false},"open_issues":151,"closed_issues":16,"state":"open","created_at":"2014-11-17T19:11:38Z","updated_at":"2015-08-11T10:22:16Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2015-08-07T15:14:09Z","updated_at":"2015-08-11T13:38:37Z","closed_at":null,"body":"Hi, I was just looking at the Marathon Dockerfile.\r\n\r\nI'm not sure which Dockerfile is actually used to build the image, whether it's this one: \r\n\r\nhttps://hub.docker.com/r/mesosphere/marathon/~/dockerfile/\r\n\r\nOr this one:\r\n\r\nhttps://github.com/mesosphere/marathon/blob/master/Dockerfile\r\n\r\n(or why the two are different), but in both cases they seem to install sbt by downloading from an http URL and without checking signatures or checksums.\r\n\r\nThis means that no guarantees can be given about what is in this image; sbt may have been tampered with either in transit or on the download site, and there is no way of telling.\r\n\r\nIt would be great if you started validating checksums or at least used an https URL. For examples of how to do this see the official images e.g. https://github.com/docker-library/redis/blob/37efc31242c8415d4f2e6d84255af0c7b97567c5/3.0/32bit/Dockerfile"},"comment":{"url":"https://api.github.com/repos/mesosphere/marathon/issues/comments/129876339","html_url":"https://github.com/mesosphere/marathon/issues/1968#issuecomment-129876339","issue_url":"https://api.github.com/repos/mesosphere/marathon/issues/1968","id":129876339,"user":{"login":"amouat","id":246775,"avatar_url":"https://avatars.githubusercontent.com/u/246775?v=3","gravatar_id":"","url":"https://api.github.com/users/amouat","html_url":"https://github.com/amouat","followers_url":"https://api.github.com/users/amouat/followers","following_url":"https://api.github.com/users/amouat/following{/other_user}","gists_url":"https://api.github.com/users/amouat/gists{/gist_id}","starred_url":"https://api.github.com/users/amouat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amouat/subscriptions","organizations_url":"https://api.github.com/users/amouat/orgs","repos_url":"https://api.github.com/users/amouat/repos","events_url":"https://api.github.com/users/amouat/events{/privacy}","received_events_url":"https://api.github.com/users/amouat/received_events","type":"User","site_admin":false},"created_at":"2015-08-11T13:38:37Z","updated_at":"2015-08-11T13:38:37Z","body":"Apologies for my previous comment, I've now figured out what's going on with the Hub builds (I'm not having a good day). You can click on the build ids to get the details.\r\n\r\nI'll come up with some suggestions next week if I can. I'd also suggest cleaning up the builds if possible. For instance, what is the difference between 0.9.1 and v0.9.1? A latest tag that points to the newest stable version would be very useful for newcomers."}}