You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maven.apache.org by gn...@apache.org on 2026/08/31 11:12:19 UTC
(maven-resolver) branch security/trust-tracking-laundering updated (e214e4730 -> 63c362908)
This is an automated email from the ASF dual-hosted git repository.
gnodet pushed a change to branch security/trust-tracking-laundering
in repository https://gitbox.apache.org/repos/asf/maven-resolver.git
omit e214e4730 fix: correct @since tags from 2.0.22 to 2.0.23
omit db623e4eb fix: prevent trust-tracking laundering through repository-id and context rewriting
add 248cb42d0 Validate coordinate components in the Maven 2 layout and local path composer (#2087)
add 68caebfd0 FileTransporter: contain resolved resource paths under the repository base (#2088)
add f67748936 Neutralize dot-only repository ids in path segment conversion (#2089)
add f511a616a Carry repository provenance into aggregateRepositories (#2090)
add ed01f7de9 Compose named lock keys one segment per coordinate field (#2091)
add e67ad9f22 fix: harden opt-in transport and lock backends against unauthenticated infrastructure (#2086)
add c82abf7eb fix: deploy-side integrity must fail closed (#2084)
add a7104fab2 fix: atomic file publication and authenticated IPC lock daemon (#2083)
add 55252d5fe fix: prevent remote signals from weakening operator-configured policy (#2082)
add 126814e53 fix: prevent trust-tracking laundering through repository-id and context rewriting
add 63c362908 fix: correct @since tags from 2.0.22 to 2.0.23
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (e214e4730)
\
N -- N -- N refs/heads/security/trust-tracking-laundering (63c362908)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
No new revisions were added by this update.
Summary of changes:
.../connector/basic/BasicRepositoryConnector.java | 50 ++-
.../BasicRepositoryConnectorConfigurationKeys.java | 18 ++
.../aether/connector/basic/ChecksumValidator.java | 18 +-
.../connector/basic/ChecksumValidatorTest.java | 48 +++
.../gnupg/GnupgSignatureArtifactGenerator.java | 66 +++-
.../generator/gnupg/GpgSignerFactoryTest.java | 26 ++
.../SigstoreSignatureArtifactGenerator.java | 121 ++++---
.../aether/impl/RemoteRepositoryManager.java | 38 +++
.../internal/impl/DefaultLocalPathComposer.java | 23 +-
.../impl/DefaultRemoteRepositoryManager.java | 185 ++++++++++-
.../internal/impl/DefaultUpdateCheckManager.java | 46 ++-
.../LocalPathPrefixComposerFactorySupport.java | 19 +-
.../impl/Maven2RepositoryLayoutFactory.java | 6 +
.../FileTrustedChecksumsSourceSupport.java | 37 +++
.../SparseDirectoryTrustedChecksumsSource.java | 81 ++++-
.../SummaryFileTrustedChecksumsSource.java | 75 ++++-
.../TrustedToProvidedChecksumsSourceAdapter.java | 31 ++
.../aether/internal/impl/collect/DataPool.java | 86 +++--
.../impl/collect/DependencyCollectorDelegate.java | 13 +-
.../impl/collect/bf/BfDependencyCollector.java | 2 +-
.../impl/collect/df/DfDependencyCollector.java | 2 +-
.../PrefixesRemoteRepositoryFilterSource.java | 89 +++++-
.../impl/synccontext/named/BasedirNameMapper.java | 19 +-
.../impl/synccontext/named/GAECVNameMapper.java | 18 +-
.../impl/synccontext/named/GAVNameMapper.java | 30 +-
.../impl/DefaultLocalPathComposerTest.java | 52 +++
.../DefaultLocalPathPrefixComposerFactoryTest.java | 26 ++
.../impl/DefaultRemoteRepositoryManagerTest.java | 350 ++++++++++++++++++++-
.../impl/DefaultUpdateCheckManagerTest.java | 49 +++
.../impl/Maven2RepositoryLayoutFactoryTest.java | 33 ++
.../FileTrustedChecksumsSourceTestSupport.java | 53 ++++
...rustedToProvidedChecksumsSourceAdapterTest.java | 52 +++
.../aether/internal/impl/collect/DataPoolTest.java | 63 ++++
...moteRepositoryFilterSourceVerifyDeniedTest.java | 53 +++-
.../synccontext/named/BasedirNameMapperTest.java | 37 +++
.../impl/synccontext/named/GAVNameMapperTest.java | 27 ++
.../HazelcastCPSemaphoreNamedLockFactory.java | 18 +-
...HazelcastClientCPSemaphoreNamedLockFactory.java | 18 +-
.../HazelcastSemaphoreNamedLockFactory.java | 36 +++
.../RequireExplicitHazelcastConfigTest.java | 63 ++++
.../org/eclipse/aether/named/ipc/IpcClient.java | 37 ++-
.../aether/named/ipc/IpcNamedLockFactory.java | 23 +-
.../org/eclipse/aether/named/ipc/IpcServer.java | 99 ++++--
.../org/eclipse/aether/named/ipc/SocketFamily.java | 37 ++-
.../aether/named/ipc/IpcNamedLockFactoryTest.java | 68 ++++
.../named/ipc/IpcServerAccessControlTest.java | 157 +++++++++
.../redisson/RedissonNamedLockFactorySupport.java | 57 ++++
.../RedissonNamedLockFactorySupportTest.java | 58 ++++
.../spi/checksums/ProvidedChecksumsSource.java | 27 ++
.../spi/checksums/TrustedChecksumsSource.java | 45 +++
.../aether/spi/io/PathProcessorSupport.java | 83 ++++-
.../aether/spi/io/PathProcessorSupportTest.java | 170 ++++++++++
.../aether/transport/file/FileTransporter.java | 16 +-
.../aether/transport/file/FileTransporterTest.java | 83 +++++
.../minio/MinioTransporterConfigurationKeys.java | 17 +
.../transport/minio/MinioTransporterFactory.java | 24 ++
.../FixedBucketObjectNameMapperFactory.java | 6 +-
.../aether/transport/minio/package-info.java | 8 +-
.../minio/MinioTransporterFactoryTest.java | 31 +-
.../FixedBucketObjectNameMapperFactoryTest.java | 69 ++++
.../java/org/eclipse/aether/util/PathUtils.java | 43 ++-
.../org/eclipse/aether/util/PathUtilsTest.java | 62 ++++
src/site/markdown/remote-repository-filtering.md | 2 +-
63 files changed, 3059 insertions(+), 240 deletions(-)
create mode 100644 maven-resolver-named-locks-hazelcast/src/test/java/org/eclipse/aether/named/hazelcast/RequireExplicitHazelcastConfigTest.java
create mode 100644 maven-resolver-named-locks-ipc/src/test/java/org/eclipse/aether/named/ipc/IpcNamedLockFactoryTest.java
create mode 100644 maven-resolver-named-locks-ipc/src/test/java/org/eclipse/aether/named/ipc/IpcServerAccessControlTest.java
create mode 100644 maven-resolver-named-locks-redisson/src/test/java/org/eclipse/aether/named/redisson/RedissonNamedLockFactorySupportTest.java
create mode 100644 maven-resolver-spi/src/test/java/org/eclipse/aether/spi/io/PathProcessorSupportTest.java
create mode 100644 maven-resolver-transport-minio/src/test/java/org/eclipse/aether/transport/minio/internal/FixedBucketObjectNameMapperFactoryTest.java