[I] Build/CI supply-chain hardening: pin the third-party action, drop the redundant repository, add wrapper checksums [camel-karaf]

["oscerd (via GitHub)" <gi...@apache.org>]

oscerd opened a new issue, #731:
URL: https://github.com/apache/camel-karaf/issues/731

   ## Description
   
   Three independent build-integrity gaps, grouped because they are all one-line
   build hygiene fixes.
   
   ### 1. Third-party GitHub Action referenced by a mutable tag
   
   `.github/workflows/main.yml:101`
   
   ```yaml
   uses: EnricoMi/publish-unit-test-result-action@v2
   ```
   
   `v2` is a mutable tag on a non-GitHub-authored action. It runs with
   `if: always()` on `push` and `pull_request`, under `contents: read` +
   `checks: write`, after the shared Maven cache is restored and before its
   post-step saves it. A force-moved tag changes what executes without any change
   landing in this repository, and Dependabot cannot detect a tag that moves
   under it. Apache infra policy is to pin third-party actions to a full commit
   SHA.
   
   ### 2. Redundant third-party repository in the root POM
   
   `pom.xml:862-874` declares the Atlassian `maven-external` repository at the
   root, so it is inherited by every module in the reactor. The identical block
   already exists, correctly scoped, at `components/camel-jira/pom.xml:45-57` --
   which covers the only artifacts that actually need it. The root declaration
   widens the set of coordinates that can be resolved from a non-Central
   repository across the whole build for no benefit.
   
   ### 3. Maven wrapper distribution is downloaded unverified
   
   `.mvn/wrapper/maven-wrapper.properties` sets neither `wrapperSha256Sum` nor
   `distributionSha256Sum`:
   
   ```
   distributionUrl=https://repo.maven.apache.org/maven2/.../apache-maven-3.9.6-bin.zip
   wrapperUrl=https://repo.maven.apache.org/maven2/.../maven-wrapper-3.2.0.jar
   ```
   
   The shipped `mvnw` already implements SHA-256 verification (`mvnw:254-278`),
   but the code is dormant because neither property is set. A 62 KB
   `maven-wrapper.jar` is also committed to the repository, where its contents
   cannot be reviewed in a diff.
   
   ## Expected Behavior
   
   - Non-GitHub-authored actions pinned to a full commit SHA, with Dependabot
     managing the bumps.
   - The root `<repositories>` block removed; `camel-jira` keeps its own.
   - `wrapperSha256Sum` and `distributionSha256Sum` set so the existing
     verification in `mvnw` becomes active.
   
   ## Actual Behavior
   
   All three are currently unpinned/unscoped as described above.
   
   ## Additional Context
   
   - Item 3 can optionally go further by switching to the `only-script` wrapper
     distribution, so no jar needs to be committed at all. That is a larger
     change and can be split out if preferred.
   
   ---
   _Claude Code on behalf of Andrea Cosentino_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Build/CI supply-chain hardening: pin the third-party action, drop the redundant repository, add wrapper checksums [camel-karaf]

["jbonofre (via GitHub)" <gi...@apache.org>]

jbonofre closed issue #731: Build/CI supply-chain hardening: pin the third-party action, drop the redundant repository, add wrapper checksums
URL: https://github.com/apache/camel-karaf/issues/731


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Build/CI supply-chain hardening: pin the third-party action, drop the redundant repository, add wrapper checksums [camel-karaf]

["oscerd (via GitHub)" <gi...@apache.org>]

oscerd commented on issue #731:
URL: https://github.com/apache/camel-karaf/issues/731#issuecomment-5400587477

   Items 1 (pin the action) and 3 (wrapper checksums) are done in #736.
   
   **Item 2 (remove the root `<repositories>` block) should not be done as
   described** — I checked it before writing the patch and it would break the
   build:
   
   - `features/src/main/feature/camel-features.xml:1996-2002` lists
     `com.atlassian.jira:jira-rest-java-client-core` / `-api`,
     `com.atlassian.sal:sal-api`, `com.atlassian.event:atlassian-event` and
     `com.atlassian.httpclient:*` as bundles of the `camel-jira` feature, and the
     `features` module runs `karaf-maven-plugin:verify`, so those coordinates have
     to resolve during the build.
   - `features/pom.xml` does not declare the Atlassian repository — it relies on
     inheriting it from the root POM.
   - None of those artifacts are published to Maven Central (every
     `maven-metadata.xml` probe returns 404), so removing the root declaration
     leaves no way to resolve them.
   
   So `components/camel-jira` is *not* the only module that needs the repository;
   that was the wrong premise in the issue description above.
   
   The change that would still achieve the intent — narrowing the inherited
   surface from every module in the reactor down to the ones that actually need
   it — is to **move** the declaration rather than delete it: keep it in
   `components/camel-jira`, add it to `features`, and drop it from the root. That
   wants a full reactor build to confirm nothing else resolves an Atlassian
   coordinate, which is why I have not bundled it into #736.
   
   Worth noting the security value here is modest either way: `maven-external` is
   a curated proxy that an attacker cannot publish to, the declaration is HTTPS,
   and snapshots are disabled. Happy to do the move as a follow-up if you think
   it is worth the reactor build to verify.
   
   ---
   _Claude Code on behalf of Andrea Cosentino_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org