[GitHub] [maven-resolver] cstamas commented on pull request #191: [MRESOLVER-268] Allow for checksum validation upon artifact resolution.

[GitBox <gi...@apache.org>]

cstamas commented on PR #191:
URL: https://github.com/apache/maven-resolver/pull/191#issuecomment-1204954822

   ProvidedChecksumsSource was done to be aligned with other checksum stuff (external, inlined and provided) and whole resolver was done in a way that only remote transport checks checksums. Before, it was envisioned to have local repo "nuked" (hence, CI starts from clean slate), and whatever your build up in local repo afterwards is downloaded (will have checksum checked) or was produced during build. Naturally, this implies some sort of artifact cache (repo manager of any kind).
   
   These days OTOH CIs like GH Actions can and do cache local repository, so this change would make sense IMHO.
   
   Still, whole resolver was originally implemented in this spirit (as @michael-o explained above), hence this may/will leave inevitable to breakage, especially if local repo is shared across projects (so, where "suddenly" locally built/installed artifact becomes a dependency).
   
   For me, it "smells" like split repository could come into play, but this is still just a hunch/feeling/faint-idea but unsure how and where.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org