- upgrade jenkins
- use checksums to enforce upgrades