You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maven.apache.org by sl...@apache.org on 2026/09/26 10:52:37 UTC
(maven-indexer) 01/01: Never index checksum or signature files as artifacts
This is an automated email from the ASF dual-hosted git repository.
slachiewicz pushed a commit to branch agent/mindexer-sidecar-recognition
in repository https://gitbox.apache.org/repos/asf/maven-indexer.git
commit adb050bd06241576cc8c52b545f7075ba34cf254
Author: Sylwester Lachiewicz <sl...@apache.org>
AuthorDate: Sat Sep 26 12:52:23 2026 +0200
Never index checksum or signature files as artifacts
DefaultArtifactContextProducer now also skips any file the GavCalculator
parses as a hash or signature, so the isIndexable suffix list can no longer
fall behind the calculator (the cause of #692). M2ArtifactRecognizer
recognizes .sha256 and .sha512 checksums too.
---
.../index/DefaultArtifactContextProducer.java | 4 ++
.../maven/index/artifact/M2ArtifactRecognizer.java | 19 ++++--
.../index/DefaultArtifactContextProducerTest.java | 67 ++++++++++++++++++++++
.../artifact/MavenArtifactRecognizerTest.java | 12 ++++
4 files changed, 97 insertions(+), 5 deletions(-)
diff --git a/indexer-core/src/main/java/org/apache/maven/index/DefaultArtifactContextProducer.java b/indexer-core/src/main/java/org/apache/maven/index/DefaultArtifactContextProducer.java
index 36f9da7f..adcbab3f 100644
--- a/indexer-core/src/main/java/org/apache/maven/index/DefaultArtifactContextProducer.java
+++ b/indexer-core/src/main/java/org/apache/maven/index/DefaultArtifactContextProducer.java
@@ -79,6 +79,10 @@ public class DefaultArtifactContextProducer implements ArtifactContextProducer {
return null; // not an artifact, but rather metadata
}
+ if (gav.isHash() || gav.isSignature()) {
+ return null; // a checksum or signature of an artifact, not the artifact itself
+ }
+
File pom;
File artifact;
diff --git a/indexer-core/src/main/java/org/apache/maven/index/artifact/M2ArtifactRecognizer.java b/indexer-core/src/main/java/org/apache/maven/index/artifact/M2ArtifactRecognizer.java
index 33725d3c..5215ddee 100644
--- a/indexer-core/src/main/java/org/apache/maven/index/artifact/M2ArtifactRecognizer.java
+++ b/indexer-core/src/main/java/org/apache/maven/index/artifact/M2ArtifactRecognizer.java
@@ -22,18 +22,29 @@ package org.apache.maven.index.artifact;
* Utility methods for basic "detection" of artifact kind in M2 repository.
*/
public class M2ArtifactRecognizer {
+ private static final String[] CHECKSUM_SUFFIXES = {".sha1", ".md5", ".sha256", ".sha512"};
+
+ private static boolean endsWithChecksumOf(String path, String suffix) {
+ for (String checksum : CHECKSUM_SUFFIXES) {
+ if (path.endsWith(suffix + checksum)) {
+ return true;
+ }
+ }
+ return false;
+ }
+
/**
* Is this item M2 Checksum?
*/
public static boolean isChecksum(String path) {
- return path.endsWith(".sha1") || path.endsWith(".md5");
+ return endsWithChecksumOf(path, "");
}
/**
* Is this item M2 POM?
*/
public static boolean isPom(String path) {
- return path.endsWith(".pom") || path.endsWith(".pom.sha1") || path.endsWith(".pom.md5");
+ return path.endsWith(".pom") || endsWithChecksumOf(path, ".pom");
}
/**
@@ -50,9 +61,7 @@ public class M2ArtifactRecognizer {
* Is this item M2 metadata?
*/
public static boolean isMetadata(String path) {
- return path.endsWith("maven-metadata.xml")
- || path.endsWith("maven-metadata.xml.sha1")
- || path.endsWith("maven-metadata.xml.md5");
+ return path.endsWith("maven-metadata.xml") || endsWithChecksumOf(path, "maven-metadata.xml");
}
public static boolean isSignature(String path) {
diff --git a/indexer-core/src/test/java/org/apache/maven/index/DefaultArtifactContextProducerTest.java b/indexer-core/src/test/java/org/apache/maven/index/DefaultArtifactContextProducerTest.java
new file mode 100644
index 00000000..1b441f4e
--- /dev/null
+++ b/indexer-core/src/test/java/org/apache/maven/index/DefaultArtifactContextProducerTest.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.index;
+
+import java.io.File;
+import java.nio.file.Path;
+
+import org.apache.maven.index.artifact.DefaultArtifactPackagingMapper;
+import org.apache.maven.index.artifact.M2GavCalculator;
+import org.apache.maven.index.context.IndexingContext;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+class DefaultArtifactContextProducerTest {
+ private static final Path REPO = Path.of("src/test/repo").toAbsolutePath();
+
+ /**
+ * Checksums and signatures are never indexed as artifacts, even if {@code isIndexable} lets them through.
+ */
+ @Test
+ void sidecarsAreNotArtifacts() {
+ DefaultArtifactContextProducer producer =
+ new DefaultArtifactContextProducer(new DefaultArtifactPackagingMapper()) {
+ @Override
+ protected boolean isIndexable(File file) {
+ return file != null;
+ }
+ };
+ IndexingContext context = mock(IndexingContext.class);
+ when(context.getRepository()).thenReturn(REPO.toFile());
+ when(context.getRepositoryId()).thenReturn("test");
+ when(context.getGavCalculator()).thenReturn(new M2GavCalculator());
+
+ Path dir = REPO.resolve("qdox/qdox/1.5");
+ for (String sidecar : new String[] {".sha256", ".sha512", ".sha1", ".md5"}) {
+ assertNull(
+ producer.getArtifactContext(
+ context, dir.resolve("qdox-1.5.jar" + sidecar).toFile()),
+ sidecar);
+ }
+ ArtifactContext jar =
+ producer.getArtifactContext(context, dir.resolve("qdox-1.5.jar").toFile());
+ assertNotNull(jar);
+ assertEquals("qdox-1.5.jar", jar.getArtifactInfo().getFileName());
+ }
+}
diff --git a/indexer-core/src/test/java/org/apache/maven/index/artifact/MavenArtifactRecognizerTest.java b/indexer-core/src/test/java/org/apache/maven/index/artifact/MavenArtifactRecognizerTest.java
index 9c202819..6eb63983 100644
--- a/indexer-core/src/test/java/org/apache/maven/index/artifact/MavenArtifactRecognizerTest.java
+++ b/indexer-core/src/test/java/org/apache/maven/index/artifact/MavenArtifactRecognizerTest.java
@@ -64,4 +64,16 @@ public class MavenArtifactRecognizerTest {
assertEquals(false, M2ArtifactRecognizer.isMetadata("aven-metadata.xml"));
assertEquals(false, M2ArtifactRecognizer.isMetadata("/javax/mail/mail/1.4/mail-1.4.jar"));
}
+
+ @Test
+ public void testChecksums() {
+ for (String checksum : new String[] {".sha1", ".md5", ".sha256", ".sha512"}) {
+ assertEquals(true, M2ArtifactRecognizer.isChecksum("aaa.jar" + checksum));
+ assertEquals(true, M2ArtifactRecognizer.isPom("aaa.pom" + checksum));
+ assertEquals(true, M2ArtifactRecognizer.isMetadata("maven-metadata.xml" + checksum));
+ }
+ assertEquals(false, M2ArtifactRecognizer.isChecksum("aaa.jar"));
+ assertEquals(false, M2ArtifactRecognizer.isChecksum("aaa.jar.asc"));
+ assertEquals(false, M2ArtifactRecognizer.isPom("aaa.jar.sha256"));
+ }
}