{"action":"created","issue":{"url":"https://api.github.com/repos/cloudfoundry/java-buildpack/issues/231","labels_url":"https://api.github.com/repos/cloudfoundry/java-buildpack/issues/231/labels{/name}","comments_url":"https://api.github.com/repos/cloudfoundry/java-buildpack/issues/231/comments","events_url":"https://api.github.com/repos/cloudfoundry/java-buildpack/issues/231/events","html_url":"https://github.com/cloudfoundry/java-buildpack/issues/231","id":106779317,"number":231,"title":"Consider support for auto-restaging of vulnerable droplets.TUF helpful ?","user":{"login":"gberche-orange","id":4748380,"avatar_url":"https://avatars.githubusercontent.com/u/4748380?v=3","gravatar_id":"","url":"https://api.github.com/users/gberche-orange","html_url":"https://github.com/gberche-orange","followers_url":"https://api.github.com/users/gberche-orange/followers","following_url":"https://api.github.com/users/gberche-orange/following{/other_user}","gists_url":"https://api.github.com/users/gberche-orange/gists{/gist_id}","starred_url":"https://api.github.com/users/gberche-orange/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gberche-orange/subscriptions","organizations_url":"https://api.github.com/users/gberche-orange/orgs","repos_url":"https://api.github.com/users/gberche-orange/repos","events_url":"https://api.github.com/users/gberche-orange/events{/privacy}","received_events_url":"https://api.github.com/users/gberche-orange/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-16T13:58:22Z","updated_at":"2015-09-21T22:42:03Z","closed_at":null,"body":"In addition to https://github.com/cloudfoundry/java-buildpack-dependency-builder/issues/6 to prevent injection of malicous code into the binary repository, I'm wondering how much [The \r\nUpdate Framework (TUF)](http://theupdateframework.com/) can be beneficial to the java buildpack when running in the easy or expert [mode](https://github.com/cloudfoundry/java-buildpack/blob/master/docs/buildpack-modes.md), especially to protect against the [following attacks](https://github.com/theupdateframework/tuf/blob/bd757d67381b8d23b8b76f3510e075f5591d8d1e/docs/tuf-spec.txt#L133-L158). \r\n\r\nIs the HTTPS transport and high availability/throughput/Dos prevention of AWS S3 sufficient ? What about in the case of the expert mode, how hard is it reach such level in a private setting ?\r\n\r\nLet me know if you prefer this discussion to happen over cf-dev@ instead.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/cloudfoundry/java-buildpack/issues/comments/142129662","html_url":"https://github.com/cloudfoundry/java-buildpack/issues/231#issuecomment-142129662","issue_url":"https://api.github.com/repos/cloudfoundry/java-buildpack/issues/231","id":142129662,"user":{"login":"nebhale","id":60754,"avatar_url":"https://avatars.githubusercontent.com/u/60754?v=3","gravatar_id":"","url":"https://api.github.com/users/nebhale","html_url":"https://github.com/nebhale","followers_url":"https://api.github.com/users/nebhale/followers","following_url":"https://api.github.com/users/nebhale/following{/other_user}","gists_url":"https://api.github.com/users/nebhale/gists{/gist_id}","starred_url":"https://api.github.com/users/nebhale/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nebhale/subscriptions","organizations_url":"https://api.github.com/users/nebhale/orgs","repos_url":"https://api.github.com/users/nebhale/repos","events_url":"https://api.github.com/users/nebhale/events{/privacy}","received_events_url":"https://api.github.com/users/nebhale/received_events","type":"User","site_admin":false},"created_at":"2015-09-21T22:42:03Z","updated_at":"2015-09-21T22:42:03Z","body":"@gberche-orange The wider buildpacks team is reviewing this.  I'm tempted to close this and simply handle it once a platform-wide system is delivered.  Thoughts?"}}