diff --git a/ReleaseNotes/ReleaseNotes-2.8.txt b/ReleaseNotes/ReleaseNotes-2.8.txt
index 94299e1..27ed297 100644
--- a/ReleaseNotes/ReleaseNotes-2.8.txt
+++ b/ReleaseNotes/ReleaseNotes-2.8.txt
@@ -735,7 +735,7 @@
 Upgrades
 --------
 
-* Update JGit to 3.0.0.201306101825-r.41-g84d2738
+* Update JGit to 3.1.0.201310021548-r
 * Update gwtorm to 1.7
 * Update guice to 4.0-beta
 * Update guava to 15.0
diff --git a/gerrit-gwtui/src/main/java/com/google/gerrit/client/change/ChangeScreen2.ui.xml b/gerrit-gwtui/src/main/java/com/google/gerrit/client/change/ChangeScreen2.ui.xml
index 523a0a6..ce8a062 100644
--- a/gerrit-gwtui/src/main/java/com/google/gerrit/client/change/ChangeScreen2.ui.xml
+++ b/gerrit-gwtui/src/main/java/com/google/gerrit/client/change/ChangeScreen2.ui.xml
@@ -174,6 +174,7 @@
       color: #444;
       vertical-align: top;
       text-align: left;
+      padding-top: 3px;
       padding-right: 5px;
       white-space: nowrap;
     }
diff --git a/gerrit-patch-jgit/src/main/java/org/eclipse/jgit/internal/storage/file/WindowCacheStatAccessor.java b/gerrit-patch-jgit/src/main/java/org/eclipse/jgit/internal/storage/file/WindowCacheStatAccessor.java
index f241daa..1e94050 100644
--- a/gerrit-patch-jgit/src/main/java/org/eclipse/jgit/internal/storage/file/WindowCacheStatAccessor.java
+++ b/gerrit-patch-jgit/src/main/java/org/eclipse/jgit/internal/storage/file/WindowCacheStatAccessor.java
@@ -14,8 +14,6 @@
 
 package org.eclipse.jgit.internal.storage.file;
 
-import org.eclipse.jgit.internal.storage.file.WindowCache;
-
 // Hack to obtain visibility to package level methods only.
 // These aren't yet part of the public JGit API.
 
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/patch/PatchFile.java b/gerrit-server/src/main/java/com/google/gerrit/server/patch/PatchFile.java
index 6fcf581..81f4352 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/patch/PatchFile.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/patch/PatchFile.java
@@ -31,7 +31,6 @@
 import org.eclipse.jgit.treewalk.TreeWalk;
 
 import java.io.IOException;
-import java.nio.charset.CharacterCodingException;
 
 /** State supporting processing of a single {@link Patch} instance. */
 public class PatchFile {
@@ -89,7 +88,6 @@
    * @throws CorruptEntityException the patch cannot be read.
    * @throws IOException the patch or complete file content cannot be read.
    * @throws NoSuchEntityException
-   * @throws CharacterCodingException the file is not a known character set.
    */
   public String getLine(final int file, final int line)
       throws CorruptEntityException, IOException, NoSuchEntityException {
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/plugins/CleanupHandle.java b/gerrit-server/src/main/java/com/google/gerrit/server/plugins/CleanupHandle.java
index b04f337..593f2c9 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/plugins/CleanupHandle.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/plugins/CleanupHandle.java
@@ -32,6 +32,7 @@
     try {
       jarFile.close();
     } catch (IOException err) {
+      PluginLoader.log.error("Cannot close " + jarFile.getName(), err);
     }
     if (!tmpFile.delete() && tmpFile.exists()) {
       PluginLoader.log.warn("Cannot delete " + tmpFile.getAbsolutePath()
diff --git a/gerrit-server/src/test/java/com/google/gerrit/server/ioutil/ColumnFormatterTest.java b/gerrit-server/src/test/java/com/google/gerrit/server/ioutil/ColumnFormatterTest.java
index 2d432e6..3b4005c 100644
--- a/gerrit-server/src/test/java/com/google/gerrit/server/ioutil/ColumnFormatterTest.java
+++ b/gerrit-server/src/test/java/com/google/gerrit/server/ioutil/ColumnFormatterTest.java
@@ -14,8 +14,6 @@
 
 package com.google.gerrit.server.ioutil;
 
-import com.google.gerrit.server.ioutil.ColumnFormatter;
-
 import junit.framework.TestCase;
 
 import java.io.PrintWriter;
diff --git a/gerrit-war/src/main/java/com/google/gerrit/httpd/SiteInitializer.java b/gerrit-war/src/main/java/com/google/gerrit/httpd/SiteInitializer.java
index 0948c46..0a9386d 100644
--- a/gerrit-war/src/main/java/com/google/gerrit/httpd/SiteInitializer.java
+++ b/gerrit-war/src/main/java/com/google/gerrit/httpd/SiteInitializer.java
@@ -23,13 +23,14 @@
 import java.sql.Connection;
 import java.sql.ResultSet;
 import java.sql.SQLException;
+import java.sql.Statement;
 
 public final class SiteInitializer {
-  private static final Logger log = LoggerFactory
+  private static final Logger LOG = LoggerFactory
       .getLogger(SiteInitializer.class);
 
-  final String sitePath;
-  final String initPath;
+  private final String sitePath;
+  private final String initPath;
 
   SiteInitializer(String sitePath, String initPath) {
     this.sitePath = sitePath;
@@ -38,10 +39,9 @@
 
   public void init() {
     try {
-
       if (sitePath != null) {
         File site = new File(sitePath);
-        log.info(String.format("Initializing site at %s",
+        LOG.info(String.format("Initializing site at %s",
             site.getAbsolutePath()));
         new BaseInit(site, false).run();
         return;
@@ -53,9 +53,8 @@
         if (site == null && initPath != null) {
           site = new File(initPath);
         }
-
         if (site != null) {
-          log.info(String.format("Initializing site at %s",
+          LOG.info(String.format("Initializing site at %s",
               site.getAbsolutePath()));
           new BaseInit(site, new ReviewDbDataSourceProvider(), false).run();
         }
@@ -63,7 +62,7 @@
         conn.close();
       }
     } catch (Exception e) {
-      log.error("Site init failed", e);
+      LOG.error("Site init failed", e);
       throw new RuntimeException(e);
     }
   }
@@ -74,10 +73,14 @@
 
   private File getSiteFromReviewDb(Connection conn) {
     try {
-      ResultSet rs = conn.createStatement().executeQuery(
-          "select site_path from system_config");
-      if (rs.next()) {
-        return new File(rs.getString(1));
+      Statement stmt = conn.createStatement();
+      try {
+        ResultSet rs = stmt.executeQuery("SELECT site_path FROM system_config");
+        if (rs.next()) {
+          return new File(rs.getString(1));
+        }
+      } finally {
+        stmt.close();
       }
       return null;
     } catch (SQLException e) {
diff --git a/lib/jgit/BUCK b/lib/jgit/BUCK
index b8ff017..3e481bf 100644
--- a/lib/jgit/BUCK
+++ b/lib/jgit/BUCK
@@ -1,15 +1,16 @@
 include_defs('//lib/maven.defs')
 
-REPO = GERRIT
-VERS = '3.0.0.201306101825-r.41-g84d2738'
+REPO = ECLIPSE
+VERS = '3.1.0.201310021548-r'
 
 maven_jar(
   name = 'jgit',
   id = 'org.eclipse.jgit:org.eclipse.jgit:' + VERS,
-  bin_sha1 = 'fec8584e9e60ab3f43c3dd136f72662818e07766',
-  src_sha1 = '398e49984b281dbcd913b3894b8b9582c8b2cf9a',
+  bin_sha1 = 'df1410e5d1deaacfb70a2441b4766b61f2795bc3',
+  src_sha1 = 'b4e3d9c9c3da39b72acf72bd913ce9dbee88a9d4',
   license = 'jgit',
   repository = REPO,
+  unsign = True,
   deps = [':ewah'],
   exclude = [
     'META-INF/eclipse.inf',
@@ -21,7 +22,7 @@
 maven_jar(
   name = 'jgit-servlet',
   id = 'org.eclipse.jgit:org.eclipse.jgit.http.server:' + VERS,
-  sha1 = 'b20c36982aa90fc08180ef4a570bf28de5e1a0ab',
+  sha1 = 'bcac91120afac59c195230537bde07175578fe79',
   license = 'jgit',
   repository = REPO,
   deps = [':jgit'],
@@ -34,7 +35,7 @@
 maven_jar(
   name = 'junit',
   id = 'org.eclipse.jgit:org.eclipse.jgit.junit:' + VERS,
-  sha1 = 'ee899f2d96b51e400ae84cd9405330a7e8ce1cb9',
+  sha1 = 'a8b47bb41cec25b1d128f7d267badbc7dcf6d9aa',
   license = 'DO_NOT_DISTRIBUTE',
   repository = REPO,
   deps = [':jgit'],
diff --git a/lib/maven.defs b/lib/maven.defs
index 7049bfa..54840e8 100644
--- a/lib/maven.defs
+++ b/lib/maven.defs
@@ -13,6 +13,7 @@
 # limitations under the License.
 
 GERRIT = 'GERRIT:'
+ECLIPSE = 'ECLIPSE:'
 MAVEN_CENTRAL = 'MAVEN_CENTRAL:'
 MAVEN_LOCAL = 'MAVEN_LOCAL:'
 
@@ -32,6 +33,7 @@
     license,
     exclude = [],
     exclude_java_sources = False,
+    unsign = False,
     deps = [],
     sha1 = '', bin_sha1 = '', src_sha1 = '',
     repository = MAVEN_CENTRAL,
@@ -72,6 +74,8 @@
     cmd.extend(['-x', x])
   if exclude_java_sources:
     cmd.append('--exclude_java_sources')
+  if unsign:
+    cmd.append('--unsign')
 
   genrule(
     name = name + '__download_bin',
diff --git a/plugins/download-commands b/plugins/download-commands
index eaeb186..05975dd 160000
--- a/plugins/download-commands
+++ b/plugins/download-commands
@@ -1 +1 @@
-Subproject commit eaeb1862180782bd5f696c79379a909dce7320b7
+Subproject commit 05975dd6c8ca44de2e01cede16a94df49a3a825f
diff --git a/tools/download_file.py b/tools/download_file.py
index 4c6e19f..8d76a40 100755
--- a/tools/download_file.py
+++ b/tools/download_file.py
@@ -25,6 +25,7 @@
 
 REPO_ROOTS = {
   'GERRIT': 'http://gerrit-maven.storage.googleapis.com',
+  'ECLIPSE': 'https://repo.eclipse.org/content/groups/releases',
   'MAVEN_CENTRAL': 'http://repo1.maven.org/maven2',
   'MAVEN_LOCAL': 'file://' + path.expanduser('~/.m2/repository'),
 }
@@ -108,6 +109,7 @@
 opts.add_option('-v', help='expected content SHA-1')
 opts.add_option('-x', action='append', help='file to delete from ZIP')
 opts.add_option('--exclude_java_sources', action='store_true')
+opts.add_option('--unsign', action='store_true')
 args, _ = opts.parse_args()
 
 root_dir = args.o
@@ -165,7 +167,22 @@
     finally:
       zf.close()
   except (BadZipfile, LargeZipFile) as err:
-    print("error opening %s: %s"  % (cache_ent, err), file=stderr)
+    print('error opening %s: %s'  % (cache_ent, err), file=stderr)
+    exit(1)
+
+if args.unsign:
+  try:
+    zf = ZipFile(cache_ent, 'r')
+    try:
+      for n in zf.namelist():
+        if (n.endswith('.RSA')
+            or n.endswith('.SF')
+            or n.endswith('.LIST')):
+          exclude.append(n)
+    finally:
+      zf.close()
+  except (BadZipfile, LargeZipFile) as err:
+    print('error opening %s: %s'  % (cache_ent, err), file=stderr)
     exit(1)
 
 safe_mkdirs(path.dirname(args.o))
@@ -173,7 +190,7 @@
   try:
     shutil.copyfile(cache_ent, args.o)
   except (shutil.Error, IOError) as err:
-    print("error copying to %s: %s" % (args.o, err), file=stderr)
+    print('error copying to %s: %s' % (args.o, err), file=stderr)
     exit(1)
   try:
     check_call(['zip', '-d', args.o] + exclude)
@@ -187,5 +204,5 @@
     try:
       shutil.copyfile(cache_ent, args.o)
     except (shutil.Error, IOError) as err:
-      print("error copying to %s: %s" % (args.o, err), file=stderr)
+      print('error copying to %s: %s' % (args.o, err), file=stderr)
       exit(1)