{"push_id":588443677,"size":3,"distinct_size":3,"ref":"refs/heads/master","head":"e3b0e68bac91afa7c68091722a8633c69994208a","before":"f598f6961be33de6dcfa44a72ee2c99191fe5312","commits":[{"sha":"89fb06d9ad4a18c21f469d5adf79d208f36b355e","author":{"email":"8800578b51f022c8d8adb9606a8b3db4fedbdac6@eds.org","name":"Hans-Christoph Steiner"},"message":"force maven to download via HTTPS\n\nmaven does not really authenticate the jars it downloads, and even worse,\nup until v3.2.3, it downloads them via plain text HTTP.  This provides a\nwealth of attacks that can take over the developer's machine from local\nwifi, ISP, etc.  To protect anyone who might be hacking on otr4j, this\nshould force the connection to use HTTPS for this repo.\n\nmaven security is terrible by default:\nhttp://blog.ontoillogical.com/blog/2014/07/28/how-to-take-over-any-java-developer/\n\nmaven users should set this globally too, to make sure:\nhttp://central.sonatype.org/pages/consumers.html#apache-maven","distinct":true,"url":"https://api.github.com/repos/otr4j/otr4j/commits/89fb06d9ad4a18c21f469d5adf79d208f36b355e"},{"sha":"e0a85e01c1c427034a03b87b3a1dff03bb60194c","author":{"email":"8800578b51f022c8d8adb9606a8b3db4fedbdac6@eds.org","name":"Hans-Christoph Steiner"},"message":"automatically check available PGP signatures on jars downloaded by maven\n\nHTTPS is not enough to make sure that the jar is legit.  HTTPS protects the\nnetwork traffic.  The PGP signature helps verify that the file up on the\nmaven repository is the same as the file that the original.  But it seems\nlike the PGP implementation in maven repos leaves a lot to be desired\nsince there is no canonical keyring to test against, like for example with\nDebian repositories.  But this is better than nothing, and works\nautomatically.","distinct":true,"url":"https://api.github.com/repos/otr4j/otr4j/commits/e0a85e01c1c427034a03b87b3a1dff03bb60194c"},{"sha":"e3b0e68bac91afa7c68091722a8633c69994208a","author":{"email":"8800578b51f022c8d8adb9606a8b3db4fedbdac6@eds.org","name":"Hans-Christoph Steiner"},"message":"remove openjdk6 as a travis build platform, it fails with HTTPS/PGP verify","distinct":true,"url":"https://api.github.com/repos/otr4j/otr4j/commits/e3b0e68bac91afa7c68091722a8633c69994208a"}]}