You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by GitBox <gi...@apache.org> on 2021/04/02 07:19:12 UTC
[GitHub] [maven] rmannibucau opened a new pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
rmannibucau opened a new pull request #462:
URL: https://github.com/apache/maven/pull/462
Following this checklist to help us incorporate your
contribution quickly and easily:
- [x] Make sure there is a [JIRA issue](https://issues.apache.org/jira/browse/MNG) filed
for the change (usually before you start working on it). Trivial changes like typos do not
require a JIRA issue. Your pull request should address just this issue, without
pulling in other changes.
- [X] Each commit in the pull request should have a meaningful subject line and body.
- [X] Format the pull request title like `[MNG-XXX] - Fixes bug in ApproximateQuantiles`,
where you replace `MNG-XXX` with the appropriate JIRA issue. Best practice
is to use the JIRA issue title in the pull request title and in the first line of the
commit message.
- [X] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
- [X] Run `mvn clean verify` to make sure basic checks pass. A more thorough check will
be performed on your pull request automatically.
- [ ] You have run the [Core IT][core-its] successfully.
[core-its]: https://maven.apache.org/core-its/core-it-suite/
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] rmannibucau commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
rmannibucau commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812504123
@michael-o as explains the topic, the goal is to provide maintenance of our versions to end users. Minimal requirement is to backport security fix on versions. Here we violated all versioning policies by not doing that + jumping from 2 versions (which can't be taken into acocunt in any project stack versioning policy) so just trying to solve that for this time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] rmannibucau closed pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
rmannibucau closed pull request #462:
URL: https://github.com/apache/maven/pull/462
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] hboutemy commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
hboutemy commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812609342
as sent to the mailing list, MNG-7118 block HTTP by default is the security fix: MNG-7116, MNG-7117 and MNG-7128 are just prerequisites: with this PR, the release keeps being vulnerable
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] michael-o commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
michael-o commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812507500
@rmannibucau You can go with a new Resolver 1.4.x first.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] eolivelli commented on a change in pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
eolivelli commented on a change in pull request #462:
URL: https://github.com/apache/maven/pull/462#discussion_r606133878
##########
File path: maven-artifact/src/main/java/org/apache/maven/artifact/repository/ArtifactRepository.java
##########
@@ -73,6 +73,12 @@
@Deprecated
void setBlacklisted( boolean blackListed );
+ /** @since 3.8.1 **/
Review comment:
3.6.?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] rmannibucau commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
rmannibucau commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812647803
@hboutemy I understand the 7118 point, I can backport it but it also means adding something to enable user to not break OOTB from what was discussed on the list.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] rmannibucau commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
rmannibucau commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812618240
@hboutemy just answered on the list. Long story short, MNG-7118 does not fix the security issue, just default it but it is bypassed in most CI and this PR is only to enable to get the security fix (external:http support) but avoids to break OOTB the 3.6 users. So all good.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] slachiewicz commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
slachiewicz commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812505301
If it's so easy to apply workaround to security issue for 3.6.3 - why still new release 3.8.x?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] michael-o commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
michael-o commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812503634
Using Maven Resolver 1.6.x in a patch release is wrong. Too much has changed there. It should be another 1.4.x if you need to.
I also do not understand the purpose of this because 3.8.x is a drop-in replacement except the new mirror handling.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] rmannibucau commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
rmannibucau commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812537590
@aheritier external:* was my first try but has too much side effects and does not fulfill the same goal, this is why i went with this option. At that time i thought we should have enabled external:pattern:xxx instead of hardcode it but for now i'm just trying to drop some blocker.
@slachiewicz IMHO a security fix is *not* a new feature as justifying a N+1 but something required in the affected version branch as discussed on the list. 3.8.1 was a core dev choice, not an user one IMHO and I'm just trying to catch up here.
@michael-o i reviewed the changelog and most of the changes are dead changes for the resolver so think it is fine to use the 1.6, there are other more impacting bumps in patch versions in general.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] aheritier commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
aheritier commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812498516
-1 for me.
It's creating too much confusion to have 2 releases doing the same thing
3.6.x users have a workaround (declare a mirror *) which they should already use if they have such security concerns
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] rmannibucau commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
rmannibucau commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812499994
@aheritier hmm, can you point me on the doc to do it for all external:http:// (3.6 equivalent) and not on a per repo basis please? Didn't find it. This is the expected fix I wanted to backport, if already doable no issue to close this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] hboutemy commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
hboutemy commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812634619
I won't discuss more MNG-7118: I just say that without MNG-7118, the CVE range won't mark this as unaffected
I just want to prevent from another independent mess: the branch chosen as starting point contains MNG-5868 that is not part of 3.8.1 (I won't discuss about other commits that are less important: I won't be picky)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] rmannibucau commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
rmannibucau commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-813248154
Rejected by the community, closing (worked around by a custom internal fork)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] aheritier commented on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
aheritier commented on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812505480
@rmannibucau no it's not possible with 3.6.x to do `external:http:// `
It's necessarily `external:*` which is what everyone taking care of security should do to use only the corporate repository
`external:http://` is a new feature, this is why it is in 3.8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] rmannibucau edited a comment on pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
rmannibucau edited a comment on pull request #462:
URL: https://github.com/apache/maven/pull/462#issuecomment-812504123
@michael-o as explains the topic, the goal is to provide maintenance of our versions to end users. Minimal requirement is to backport security fix on versions. Here we violated all versioning policies by not doing that + jumping from 2 versions (which can't be taken into acocunt in any project stack versioning policy) so just trying to solve that for this time.
Edit: resolver 1.6 is needed to get blocked support.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] rmannibucau commented on a change in pull request #462: [MNG-7134] Backport security fix in 3.6.x branch
Posted by GitBox <gi...@apache.org>.
rmannibucau commented on a change in pull request #462:
URL: https://github.com/apache/maven/pull/462#discussion_r606136287
##########
File path: maven-artifact/src/main/java/org/apache/maven/artifact/repository/ArtifactRepository.java
##########
@@ -73,6 +73,12 @@
@Deprecated
void setBlacklisted( boolean blackListed );
+ /** @since 3.8.1 **/
Review comment:
Good catch, fixed, thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org