Re: Securely obtain the Jenkins package and public key

2014-01-15 Thread abhijith chandrashekar
ijith On Mon, Jan 13, 2014 at 1:46 AM, teilo wrote: > > On Sunday, 12 January 2014 22:20:17 UTC, Abhijith Chandrashekar wrote: >> >> > Of course, you'd need a secure way to make sure it's actually his >> signature, but that should be easier than changing the

Re: Securely obtain the Jenkins package and public key

2014-01-12 Thread abhijith chandrashekar
Beck wrote: > On 08.01.2014, at 23:08, Abhijith Chandrashekar < > abhijith.chandrashe...@gmail.com> wrote: > > > This raises possibilities of a Man-in-the-middle attack compromising the > integrity of the repo or the key or both. > > The war packages themselves are signed b

Securely obtain the Jenkins package and public key

2014-01-08 Thread Abhijith Chandrashekar
Hello all, I work with a tech company where we're trying to establish a pristine build environment for all of our products. As part of this, we are looking to create a Jenkins CI server from scratch using the most secure methods possible. This would be on an underlying CentOS 6.2 machine. From