You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by GitBox <gi...@apache.org> on 2022/12/09 12:47:23 UTC
[GitHub] [maven-site] bmarwell opened a new pull request, #354: [MNGSITE-503] add .well-known/security.txt
bmarwell opened a new pull request, #354:
URL: https://github.com/apache/maven-site/pull/354
References:
* [.well-known/security.txt at maven.apache.org (mail-archive.com)](https://www.mail-archive.com/dev@maven.apache.org/msg128366.html)
* [.well-known/security.txt at maven.apache.org-Apache Mail Archives](https://lists.apache.org/thread/tvfg1lx9nd72c9t4t4s3zlx6l0tpnmwy)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345600516
> > Then just drop to date only. Fully valid ISO date
>
> Spec explicitly asks for date and **TIME**.
>
> +1 for Hervés suggestion, will add later.
https://www.rfc-editor.org/rfc/rfc9116#section-2.5.5 does not say that. It just says that the format has to comply with ISO 8601. Moreover, the example is invalid according to ISO 8601 and this I wrote Yakov yesterday. Unless it uses the word MUST a local date is more than enough. Everything else is a problem with the RFC itself.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345373414
@bmarwell This is what you were looking for:
```diff
diff --git a/pom.xml b/pom.xml
index a7d46e96..8686e1e1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -251,6 +251,8 @@
<configuration>
<name>maven.security.expires</name>
<pattern>yyyy-MM-dd'T'HH:mm:ssXXX</pattern>
+ <!-- This ulgy Plexus magic will coerce in the plugin Locale#ROOT -->
+ <locale xml:space="preserve"> </locale>
<offset>+1</offset>
<unit>year</unit>
</configuration>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1044893006
##########
pom.xml:
##########
@@ -232,6 +232,32 @@
-->
</executions>
</plugin>
+ <!--
+ used for timestamp of .well-known/security.txt file
+ Plugin-definition must be before resources-plugin to be
+ in the pre-site phase before 'copy-filtered-resources'.
+ -->
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>build-helper-maven-plugin</artifactId>
+ <version>3.3.0</version>
+ <executions>
+ <execution>
+ <id>create-security.txt-timestamp</id>
+ <phase>pre-site</phase>
+ <goals>
+ <goal>timestamp-property</goal>
+ </goals>
+ <configuration>
+ <name>maven.security.expires</name>
+ <locale>ROOT</locale>
+ <pattern>yyyy-MM-dd'T'HH:mm:ss'Z'</pattern>
+ <offset>+1</offset>
+ <unit>year</unit>
+ </configuration>
Review Comment:
Yes, that's the idea. It's the time when the information is considered stale/expired. As long as we deploy the site, it must be active for another year or so.
See the RFC from the mailing list and this article: https://developer.okta.com/blog/2021/10/19/intro-security-txt
We do the same in Apache Shiro.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345364007
> So you are uploading an expired file. Expires MUST be in the future!
Oh man, I am so stupid. You are right, of course. I left this out complete. I guess I should not code anymore today. But still, having the date being set automatically, I consider wrong because the provided information much be manually reviewed.
Please drop the commit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell merged pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell merged PR #354:
URL: https://github.com/apache/maven-site/pull/354
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345360839
@bmarwell I have added a commit which does it right. No fuzz, no additonal plugins. WFM:
```
Contact: mailto:security@apache.org
Contact: mailto:private@maven.apache.org
Expires: 2022-12-10T18:48:02Z
Preferred-Languages: en
Policy: https://www.apache.org/security/
Policy: https://maven.apache.org/security.html
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345254727
@michael-o now we have this:
```
[INFO] --- build-helper-maven-plugin:3.3.0:timestamp-property (create-security.txt-timestamp) @ maven-site ---
[WARNING] Using platform locale (en_US actually) to format date/time, i.e. build is platform dependent!
```
I still suggest adding root or to explicitly set `<locale>${user.locale}</locale>`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] hboutemy commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
hboutemy commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1045261766
##########
content/filtered-resources/.well-known/security.txt:
##########
@@ -0,0 +1,6 @@
+Contact: mailto:security@apache.org
+Contact: mailto:private@maven.apache.org
+Expires: ${maven.build.timestamp}
+Preferred-Languages: en
+Policy: https://www.apache.org/security/
+Policy: https://maven.apache.org/security.html
Review Comment:
IIUC, the intent in the RFC is to link to policies, not history. I don't really have any experience with this RFC.
Given it seems intended for people to read, humans can guess I suppose, then not a strict problem: do as you feel better
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345601859
So, a researcher in the US gets more time. Interesting!
Tbh I think only an instant makes sense to avoid this. Probably all scanners try to parse a time and "Z". It doesn't even hurt.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] slawekjaranowski commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
slawekjaranowski commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1044477516
##########
content/filtered-resources/.well-known/security.txt:
##########
@@ -0,0 +1,6 @@
+Contact: mailto:security@apache.org
+Contact: mailto:security@maven.apache.org
Review Comment:
Is there such address, lists?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1045125369
##########
content/filtered-resources/.well-known/security.txt:
##########
@@ -0,0 +1,6 @@
+Contact: mailto:security@apache.org
+Contact: mailto:private@maven.apache.org
+Expires: ${maven.build.timestamp}
+Preferred-Languages: en
+Policy: https://www.apache.org/security/
+Policy: https://maven.apache.org/security.html
Review Comment:
> This one does not point to any policy. Just to a listing w/o any benefit for a potentional reporter.
Are you reading the spec at all? Or just posting random comments?
> A link to a policy detailing what security researchers should do when searching for or reporting security issues.
https://www.rfc-editor.org/rfc/rfc9116#section-2.5.7
Both pages contain useful information for security researchers: email addresses, disclosure policy, etc.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345370568
Plexus XML handling coerces both: `<locale> </locale>` and `<locale></locale>` to `null` instead of `""` which is actually what you want/need. The only way to fix this is to do `"ROOT".equals(this.locale)`...`locale = Locale.ROOT`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345374960
Here it is: https://issues.apache.org/jira/browse/MNG-6434
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1044897609
##########
pom.xml:
##########
@@ -232,6 +232,32 @@
-->
</executions>
</plugin>
+ <!--
+ used for timestamp of .well-known/security.txt file
+ Plugin-definition must be before resources-plugin to be
+ in the pre-site phase before 'copy-filtered-resources'.
+ -->
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>build-helper-maven-plugin</artifactId>
+ <version>3.3.0</version>
+ <executions>
+ <execution>
+ <id>create-security.txt-timestamp</id>
+ <phase>pre-site</phase>
+ <goals>
+ <goal>timestamp-property</goal>
+ </goals>
+ <configuration>
+ <name>maven.security.expires</name>
+ <locale>ROOT</locale>
+ <pattern>yyyy-MM-dd'T'HH:mm:ss'Z'</pattern>
Review Comment:
Can do. But your answer doesn't make sense. I can change from literal `'Z'` to the TZ pattern `XXX`. But a literal XXX would not be a valid ISO-8601 time. Judging from other posts on GitHub, you didn't mean to include the single quotes and you do want the offset to be printed, so we don't lie about a few hours?
Please note, currently we have a literal Z, not the pattern Z. Your answer would have made more sense without the quotes, which is why I ask.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345368961
> > > @michael-o now we have this:
> > > ```
> > > [INFO] --- build-helper-maven-plugin:3.3.0:timestamp-property (create-security.txt-timestamp) @ maven-site ---
> > > [WARNING] Using platform locale (en_US actually) to format date/time, i.e. build is platform dependent!
> > > ```
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > I still suggest adding root or to explicitly set `<locale>ROOT</locale>`.
> >
> >
> > This does not work. Again, providing `<locale>ROOT</locale>` will _not_ give you `Locale#ROOT`. Look at the code. There is no handling for this. All it will give you is `new Locale("root")` which does not exist and is wrong. You need something like [this](https://github.com/apache/maven-doxia-sitetools/blob/61c80011767d6159e7f4dd7e456a542d98022b24/doxia-integration-tools/src/main/java/org/apache/maven/doxia/tools/DefaultSiteTool.java#L847-L850) to handle the literal `ROOT`.
>
> I did and I ran it and it worked as expected for me. Minus one hour (I live in Europe/Berlin).
>
> Code path:
>
> ```
> Locale locale;
> if ( this.locale != null )
> {
> String[] bits = this.locale.split( "[,_]" );
> if ( bits.length == 1 )
> {
> locale = new Locale( bits[0].trim() );
> }
> ```
>
> It splits "ROOT" wich returns length 1 and Will just pass it though.
>
> I still don't know how you think it's going to be lower case.
>
> As an alternative, we can pass in
>
> ```
> <locale>${user.lang}_${user.country}</locale>
> ```
>
> ...which is the same, but just explicit.
Read the specs of the `Locale` constructor and what `Locale#ROOT` is. You are misunderstanding the behavior. It does not give you what you expect.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345370360
I still don't believe it matters as the format string does not contain any locale-specific patterns.
But if you insist, why not use the Maven properties I suggested?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] kwin commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
kwin commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1045181161
##########
pom.xml:
##########
@@ -232,6 +232,33 @@
-->
</executions>
</plugin>
+ <!--
+ used for timestamp of .well-known/security.txt file
+ Plugin-definition must be before resources-plugin to be
+ in the pre-site phase before 'copy-filtered-resources'.
+ -->
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>build-helper-maven-plugin</artifactId>
+ <version>3.3.0</version>
+ <executions>
+ <execution>
+ <id>create-security.txt-timestamp</id>
+ <phase>pre-site</phase>
+ <goals>
+ <goal>timestamp-property</goal>
+ </goals>
+ <configuration>
+ <name>maven.security.expires</name>
+ <pattern>yyyy-MM-dd'T'HH:mm:ssXXX</pattern>
+ <!-- This ulgy Plexus magic will be coerced in the plugin to Locale#ROOT -->
Review Comment:
```suggestion
<!-- This ugly Plexus magic will be coerced in the plugin to Locale#ROOT -->
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345598388
> Then just drop to date only. Fully valid ISO date
Spec explicitly asks for date and **TIME**.
+1 for Hervés suggestion, will add later.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1045079240
##########
pom.xml:
##########
@@ -232,6 +232,32 @@
-->
</executions>
</plugin>
+ <!--
+ used for timestamp of .well-known/security.txt file
+ Plugin-definition must be before resources-plugin to be
+ in the pre-site phase before 'copy-filtered-resources'.
+ -->
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>build-helper-maven-plugin</artifactId>
+ <version>3.3.0</version>
+ <executions>
+ <execution>
+ <id>create-security.txt-timestamp</id>
+ <phase>pre-site</phase>
+ <goals>
+ <goal>timestamp-property</goal>
+ </goals>
+ <configuration>
+ <name>maven.security.expires</name>
+ <locale>ROOT</locale>
Review Comment:
It does. `ROOT` works well. `'Z'` in combination with `ROOT` made sense, but now that we are going to use `XXX` I agree to remove it (for another reason, though).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345305885
> Two issues:
> * I think that using this plugin is redundant when we have this: https://maven.apache.org/guides/introduction/introduction-to-the-pom.html#special-variables
> * Pushing the expires every time like not a having an expires at all. I'd rather make it a *fixed date* and 1 month before evaluate again. It is like push the appointment with the dentist every time.
Huh. It's manual work and highly likely it's forgotten. It's very likely that
* We push this project at least once or twice a year
* The project is being maintained (or at least reachable) about 12 months after pushing out the last release.
-1 for a fixed date.
* It doesn't add any value
* Can easily be forgotten
* Needs extra pushes/releases.
The special variable doesn't work with offsets. And I fail to see how this would help. The expiry format MUST BE an ISO 8601 timestamp.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1045200050
##########
content/filtered-resources/.well-known/security.txt:
##########
@@ -0,0 +1,6 @@
+Contact: mailto:security@apache.org
+Contact: mailto:private@maven.apache.org
+Expires: ${maven.build.timestamp}
+Preferred-Languages: en
+Policy: https://www.apache.org/security/
+Policy: https://maven.apache.org/security.html
Review Comment:
Ah. I linked it because of the existing CVEs. This might have been helpful. But if you really only want to include links to policies, that's okay for me, too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1044919562
##########
pom.xml:
##########
@@ -232,6 +232,32 @@
-->
</executions>
</plugin>
+ <!--
+ used for timestamp of .well-known/security.txt file
+ Plugin-definition must be before resources-plugin to be
+ in the pre-site phase before 'copy-filtered-resources'.
+ -->
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>build-helper-maven-plugin</artifactId>
+ <version>3.3.0</version>
+ <executions>
+ <execution>
+ <id>create-security.txt-timestamp</id>
+ <phase>pre-site</phase>
+ <goals>
+ <goal>timestamp-property</goal>
+ </goals>
+ <configuration>
+ <name>maven.security.expires</name>
+ <locale>ROOT</locale>
+ <pattern>yyyy-MM-dd'T'HH:mm:ss'Z'</pattern>
+ <offset>+1</offset>
+ <unit>year</unit>
+ </configuration>
Review Comment:
Understood.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345371692
> I still don't believe it matters as the format string does not contain any locale-specific patterns. But if you insist, why not use the Maven properties I suggested?
I did not say that it does matter, all I am telling is that `<locale />` does not behave the way you assume. Since we cannot really request `Locale#ROOT` I would use a really non-existing value and document it as such, e.g. `BOGUS`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1044674863
##########
content/filtered-resources/.well-known/security.txt:
##########
@@ -0,0 +1,6 @@
+Contact: mailto:security@apache.org
+Contact: mailto:security@maven.apache.org
Review Comment:
Yes, you can repeat this according to RFCs.
The first address is the general a.o address which can be found on the linked security policy website.
The second one SHOULD exist. It's an address (mailing list) which is created for each PMC.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1045059586
##########
pom.xml:
##########
@@ -232,6 +232,32 @@
-->
</executions>
</plugin>
+ <!--
+ used for timestamp of .well-known/security.txt file
+ Plugin-definition must be before resources-plugin to be
+ in the pre-site phase before 'copy-filtered-resources'.
+ -->
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>build-helper-maven-plugin</artifactId>
+ <version>3.3.0</version>
+ <executions>
+ <execution>
+ <id>create-security.txt-timestamp</id>
+ <phase>pre-site</phase>
+ <goals>
+ <goal>timestamp-property</goal>
+ </goals>
+ <configuration>
+ <name>maven.security.expires</name>
+ <locale>ROOT</locale>
Review Comment:
This will not work: https://www.mojohaus.org/build-helper-maven-plugin/xref/org/codehaus/mojo/buildhelper/TimestampPropertyMojo.html#L122
It does not process `ROOT` for `new Locale("")`.
##########
pom.xml:
##########
@@ -232,6 +232,32 @@
-->
</executions>
</plugin>
+ <!--
+ used for timestamp of .well-known/security.txt file
+ Plugin-definition must be before resources-plugin to be
+ in the pre-site phase before 'copy-filtered-resources'.
+ -->
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>build-helper-maven-plugin</artifactId>
+ <version>3.3.0</version>
+ <executions>
+ <execution>
+ <id>create-security.txt-timestamp</id>
+ <phase>pre-site</phase>
+ <goals>
+ <goal>timestamp-property</goal>
+ </goals>
+ <configuration>
+ <name>maven.security.expires</name>
+ <locale>ROOT</locale>
+ <pattern>yyyy-MM-dd'T'HH:mm:ss'Z'</pattern>
Review Comment:
Corrected request.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345367729
> > @michael-o now we have this:
> >
> > ```
> > [INFO] --- build-helper-maven-plugin:3.3.0:timestamp-property (create-security.txt-timestamp) @ maven-site ---
> > [WARNING] Using platform locale (en_US actually) to format date/time, i.e. build is platform dependent!
> > ```
> >
> > I still suggest adding root or to explicitly set `<locale>ROOT</locale>`.
>
> This does not work. Again, providing `<locale>ROOT</locale>` will *not* give you `Locale#ROOT`. Look at the code. There is no handling for this. All it will give you is `new Locale("root")` which does not exist and is wrong. You need something like [this](https://github.com/apache/maven-doxia-sitetools/blob/61c80011767d6159e7f4dd7e456a542d98022b24/doxia-integration-tools/src/main/java/org/apache/maven/doxia/tools/DefaultSiteTool.java#L847-L850) to handle the literal `ROOT`.
I did and I ran it and it worked as expected for me. Minus one hour (I live in Europe/Berlin).
Code path:
```
Locale locale;
if ( this.locale != null )
{
String[] bits = this.locale.split( "[,_]" );
if ( bits.length == 1 )
{
locale = new Locale( bits[0].trim() );
}
```
It splits "ROOT" wich returns length 1 and Will just pass it though.
I still don't know how you think it's going to be lower case.
As an alternative, we can pass in
```xml
<locale>${user.lang}_${user.country}</locale>
```
...which is the same, but just explicit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345372396
@kwin I know that you have been working on this Plexus non-sense with trimming and to null coercion. Do you remember by any chance why an empty string is coerced to `null`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345364430
I just have reported a bug in RFC 9116. Quite embarassing one.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1044919421
##########
pom.xml:
##########
@@ -232,6 +232,32 @@
-->
</executions>
</plugin>
+ <!--
+ used for timestamp of .well-known/security.txt file
+ Plugin-definition must be before resources-plugin to be
+ in the pre-site phase before 'copy-filtered-resources'.
+ -->
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>build-helper-maven-plugin</artifactId>
+ <version>3.3.0</version>
+ <executions>
+ <execution>
+ <id>create-security.txt-timestamp</id>
+ <phase>pre-site</phase>
+ <goals>
+ <goal>timestamp-property</goal>
+ </goals>
+ <configuration>
+ <name>maven.security.expires</name>
+ <locale>ROOT</locale>
+ <pattern>yyyy-MM-dd'T'HH:mm:ss'Z'</pattern>
Review Comment:
Copy and paste, of course the latter without the quotes. Thanks for the sharp eye.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] hboutemy commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
hboutemy commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345568583
one idea: shouldn't we simplify with
```
<pattern>yyyy-MM-'01T'00:00:00Z'</pattern>
```
ie just round to month, and forget about all the details for locale?
that would match the spirit of having an automatic date that is not changed too much (one per month, not every rebuild)
WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345366315
> @michael-o now we have this:
>
> ```
> [INFO] --- build-helper-maven-plugin:3.3.0:timestamp-property (create-security.txt-timestamp) @ maven-site ---
> [WARNING] Using platform locale (en_US actually) to format date/time, i.e. build is platform dependent!
> ```
>
> I still suggest adding root or to explicitly set `<locale>ROOT</locale>`.
This does not work. Again, providing `<locale>ROOT</locale>` will *not* give you `Locale#ROOT`. Look at the code. There is not handling for this. All it will give you is `new Locale("root")` which does not exist and is wrong.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1044864320
##########
pom.xml:
##########
@@ -232,6 +232,32 @@
-->
</executions>
</plugin>
+ <!--
+ used for timestamp of .well-known/security.txt file
+ Plugin-definition must be before resources-plugin to be
+ in the pre-site phase before 'copy-filtered-resources'.
+ -->
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>build-helper-maven-plugin</artifactId>
+ <version>3.3.0</version>
+ <executions>
+ <execution>
+ <id>create-security.txt-timestamp</id>
+ <phase>pre-site</phase>
+ <goals>
+ <goal>timestamp-property</goal>
+ </goals>
+ <configuration>
+ <name>maven.security.expires</name>
+ <locale>ROOT</locale>
+ <pattern>yyyy-MM-dd'T'HH:mm:ss'Z'</pattern>
Review Comment:
Don't use `'Z'`, always use `XXX`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345608669
> When I open the RFC it clearly says
>
> > The "Expires" field indicates the date and time[...]
>
> and
>
> > The value of this field is formatted according to[...]
>
> I think it couldn't be more clear. They require date and time in the format defined in 8601. While 8601 also defines LocalDate, in this case they want a DateTimeInstant defined how 8601 would want to have it.
This is not what I understand. The specification is not concrete enough for me. A telescoping approach should be fine otherwise an erratum is necessary.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1044864320
##########
pom.xml:
##########
@@ -232,6 +232,32 @@
-->
</executions>
</plugin>
+ <!--
+ used for timestamp of .well-known/security.txt file
+ Plugin-definition must be before resources-plugin to be
+ in the pre-site phase before 'copy-filtered-resources'.
+ -->
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>build-helper-maven-plugin</artifactId>
+ <version>3.3.0</version>
+ <executions>
+ <execution>
+ <id>create-security.txt-timestamp</id>
+ <phase>pre-site</phase>
+ <goals>
+ <goal>timestamp-property</goal>
+ </goals>
+ <configuration>
+ <name>maven.security.expires</name>
+ <locale>ROOT</locale>
+ <pattern>yyyy-MM-dd'T'HH:mm:ss'Z'</pattern>
Review Comment:
Don't use `'Z'`, always use `'XXX'`.
##########
pom.xml:
##########
@@ -232,6 +232,32 @@
-->
</executions>
</plugin>
+ <!--
+ used for timestamp of .well-known/security.txt file
+ Plugin-definition must be before resources-plugin to be
+ in the pre-site phase before 'copy-filtered-resources'.
+ -->
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>build-helper-maven-plugin</artifactId>
+ <version>3.3.0</version>
+ <executions>
+ <execution>
+ <id>create-security.txt-timestamp</id>
+ <phase>pre-site</phase>
+ <goals>
+ <goal>timestamp-property</goal>
+ </goals>
+ <configuration>
+ <name>maven.security.expires</name>
+ <locale>ROOT</locale>
+ <pattern>yyyy-MM-dd'T'HH:mm:ss'Z'</pattern>
+ <offset>+1</offset>
+ <unit>year</unit>
+ </configuration>
Review Comment:
What is the purpose of this? It will change every time the site gets deployed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1045124193
##########
content/filtered-resources/.well-known/security.txt:
##########
@@ -0,0 +1,6 @@
+Contact: mailto:security@apache.org
+Contact: mailto:private@maven.apache.org
+Expires: ${maven.build.timestamp}
+Preferred-Languages: en
+Policy: https://www.apache.org/security/
+Policy: https://maven.apache.org/security.html
Review Comment:
This one does not point to any policy. Just to a listing w/o any benefit for a potentional reporter.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345362771
So you are uploading an expired file. Expires MUST be in the future!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345602186
When I open the RFC it clearly says
> The "Expires" field indicates the date and time[...]
I think it couldn't be more clear.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345653699
> This is not what I understand. The specification is not concrete enough for me.
That's a legit statement. However, it could take some considerable amount of time until the issue you opened has been resolved (i.e. clarification and fix of the example). As @bdemers, @hboutemy and @slawekjaranowski are okay with the state as-is, let’s merge it and come back later if it needs attention.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] slawekjaranowski commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
slawekjaranowski commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1044752527
##########
content/filtered-resources/.well-known/security.txt:
##########
@@ -0,0 +1,6 @@
+Contact: mailto:security@apache.org
+Contact: mailto:security@maven.apache.org
Review Comment:
security@maven should be checked ... try send an email 😄 maybe it is an alias for private list
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] bmarwell commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
bmarwell commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345323411
Removing the locale now leads to a warning that the build is system dependent. Is this really wanted? I feel having warnings intentionally seems odd. This might get "fixed" by someone else in the future who didn't read this thread.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1045214262
##########
content/filtered-resources/.well-known/security.txt:
##########
@@ -0,0 +1,6 @@
+Contact: mailto:security@apache.org
+Contact: mailto:private@maven.apache.org
+Expires: ${maven.build.timestamp}
+Preferred-Languages: en
+Policy: https://www.apache.org/security/
+Policy: https://maven.apache.org/security.html
Review Comment:
That is what I was talking about
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1045126621
##########
content/filtered-resources/.well-known/security.txt:
##########
@@ -0,0 +1,6 @@
+Contact: mailto:security@apache.org
+Contact: mailto:private@maven.apache.org
+Expires: ${maven.build.timestamp}
+Preferred-Languages: en
+Policy: https://www.apache.org/security/
+Policy: https://maven.apache.org/security.html
Review Comment:
I read it and I consider the second one useless. The only valuable information is: "For more information about reporting vulnerabilities, see the [Apache Security Team](https://www.apache.org/security/) page." This is as good as leaving it out. It provides no benefit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] michael-o commented on pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
michael-o commented on PR #354:
URL: https://github.com/apache/maven-site/pull/354#issuecomment-1345579423
> one idea: shouldn't we simplify with
>
> ```
> <pattern>yyyy-MM-'01T00:00:00Z'</pattern>
> ```
>
> ie just round to month, and forget about all the details for locale?
>
> that would match the spirit of having an automatic date, but without having it changed too much: once per month, not every rebuild (then no noise at svnpubsub level on each build)
>
> WDYT?
Then just drop to date only. Fully valid ISO date
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven-site] hboutemy commented on a diff in pull request #354: [MNGSITE-503] add .well-known/security.txt
Posted by GitBox <gi...@apache.org>.
hboutemy commented on code in PR #354:
URL: https://github.com/apache/maven-site/pull/354#discussion_r1045199323
##########
content/filtered-resources/.well-known/security.txt:
##########
@@ -0,0 +1,6 @@
+Contact: mailto:security@apache.org
+Contact: mailto:private@maven.apache.org
+Expires: ${maven.build.timestamp}
+Preferred-Languages: en
+Policy: https://www.apache.org/security/
+Policy: https://maven.apache.org/security.html
Review Comment:
AFAIK, https://maven.apache.org/security.html does not provide anything related to policy, just eventually the link to https://www.apache.org/security/ = the previous link
I think we should keep only the first "Policy" entry, not the second one
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org