[jira] [Commented] (MRESOLVER-275) Introduce trusted checksums source

["Hudson (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/MRESOLVER-275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17612404#comment-17612404 ] 

Hudson commented on MRESOLVER-275:
----------------------------------

Build succeeded in Jenkins: Maven » Maven TLP » maven-resolver » master #55

See https://ci-maven.apache.org/job/Maven/job/maven-box/job/maven-resolver/job/master/55/

> Introduce trusted checksums source
> ----------------------------------
>
>                 Key: MRESOLVER-275
>                 URL: https://issues.apache.org/jira/browse/MRESOLVER-275
>             Project: Maven Resolver
>          Issue Type: Improvement
>          Components: Resolver
>            Reporter: Tamás Cservenák
>            Assignee: Tamás Cservenák
>            Priority: Major
>             Fix For: resolver-next
>
>
> Provided checksums are introduced as 3rd kind of ChecksumKind (external, inlined, provided). But new usses for provided checksums were requested in area that is not at all "transport" (connector, transport, artifact download) related at all, while {{ProvidedChecksumsSource}} interface is bound to "transport" (uses classes from transport).
> Hence, to make a clear distinction, introduce new component: "trusted" checksum source, that is generic, is not transport bound and "push" the existing implementation below, and adapt "trusted" checksum source into "provided" checksum source as needed. This clearly separates notion of "provided checksusm (for transport)" from "trusted checksums (usable across places not even transport related).
> Note: resolver does NOT do anything for "trust", it is completely up to implementation and user, how these checksums are obtained and does user trusts them.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)