+
+When the data access approval system, data analysis system, and data repository system are all tightly integrated and are running in the same infrastructure, secure data access is simpler. When the data holder and access authorization systems are operated separately, then it becomes harder to meet two fundamental needs:
+
+* unlock data access for the researcher
+* uphold the authority of the data custodian
+
+GA4GH AAI and Passports make it easier to solve both problems by communicating the access grants (authorizations) in a JWT token accessed via OAuth2. This mechanism is easy to implement and secure because it uses standard and secure means including the OIDC, OAuth2, and JWT standards, as well as approved cryptography algorithms.
+
+AAI and Passports minimize risk and cost by:
+
+* reusing existing and familiar libraries and tools
+* leveraging existing security regimens
+* simplifying compliance and system interconnection approvals
diff --git a/jekyll-builder-local/Dockerfile b/jekyll-builder-local/Dockerfile
index 7356f39..1cc9e66 100644
--- a/jekyll-builder-local/Dockerfile
+++ b/jekyll-builder-local/Dockerfile
@@ -1,15 +1,15 @@
FROM ruby:3.2.2-alpine
ENV PLANTUML_VERSION=1.2023.6
-ENV LANG en_US.UTF-8
+ENV LANG=en_US.UTF-8
+ENV BUNDLE_FORCE_RUBY_PLATFORM=1
WORKDIR /srv/jekyll
COPY Gemfile .
# construct a Jekyll builder that comes pre-installed with plantuml runnable as a binary
RUN \
- apk add --no-cache graphviz wget ca-certificates && \
- apk add --no-cache graphviz wget ca-certificates ttf-dejavu fontconfig build-base && \
+ apk add --no-cache graphviz wget ca-certificates ttf-dejavu fontconfig build-base openjdk11 && \
wget "http://downloads.sourceforge.net/project/plantuml/${PLANTUML_VERSION}/plantuml.${PLANTUML_VERSION}.jar" -O /usr/bin/plantuml.jar
EXPOSE 4000/tcp
diff --git a/jekyll-builder-local/plantuml b/jekyll-builder-local/plantuml
index ee85357..f73fe8a 100755
--- a/jekyll-builder-local/plantuml
+++ b/jekyll-builder-local/plantuml
@@ -1,3 +1,3 @@
#!/bin/sh
-java -jar /usr/bin/plantuml.jar "$@"
+java -Djava.awt.headless=true -jar /usr/bin/plantuml.jar "$@"