[tbb-bugs] #30280 [Applications/Tor Browser]: Wrong SHA-256 sum for j2objc-annotations-1.1.jar

Tor Bug Tracker & Wiki blackhole at torproject.org
Wed Apr 24 17:23:40 UTC 2019

#30280: Wrong SHA-256 sum for j2objc-annotations-1.1.jar
 Reporter:  gk                                   |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:  new
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-mobile, tbb-rbm,                 |  Actual Points:
  TorBrowserTeam201904                           |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:

Comment (by sisbell):

 If we look at maven central, we see the later 2017 version


 If we go to ibiblio, we see the earlier 2016 version

 So it does look like bintray pulled from ibiblio and then later from maven
 central. We don't have any assurances bintray wouldn't switch back at some

 My suggestion at this point, is to dump all uses of bintray. There is
 nothing stopping someone from overriding artifacts, using this as a back
 door. We can point all references directly to maven central and then to
 ibiblio in the (unlikely) situation that central doesn't host the

Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30280#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

More information about the tbb-bugs mailing list