[GitHub] [maven-resolver] cstamas commented on pull request #191: [MRESOLVER-268] Allow for checksum validation upon artifact resolution.

[GitBox <gi...@apache.org>]

cstamas commented on PR #191:
URL: https://github.com/apache/maven-resolver/pull/191#issuecomment-1253506892

   After reviewing the intent from https://issues.apache.org/jira/browse/MRESOLVER-268 ("to retain the integrity of a project also when sharing a local Maven repository with other, unsecured projects"), I'd call this somewhat a too "edgy" use case, partially due already mentioned fact, that installed artifacts have no checksums installed, only downloaded ones have them. Hence, if two or more (unrelated) projects share same local repository, the checksum-less artifact installed by one may become a "foreign" dependency in another. Also, as this PR does, checksumming (over and over again) ALL resolved files, it is too much overhead IMHO.
   
   Am putting this PR "on hold", to have a discussion about this. Personally, am on side to keep "provided checksums" what they are meant to be: **third type of transport checksums**. This seems to me like some sort of misuse of them.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org