[ https://issues.apache.org/jira/browse/MNGSITE-299?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Robert Scholte closed MNGSITE-299. ---------------------------------- Resolution: Invalid Assignee: Robert Scholte You should ask the writer of the blog to update those links, nothing we can do about it. > Download security flaw > ---------------------- > > Key: MNGSITE-299 > URL: https://issues.apache.org/jira/browse/MNGSITE-299 > Project: Maven Project Web Site > Issue Type: Bug > Environment: any - raspberry pi in particular > Reporter: Warren MacEvoy > Assignee: Robert Scholte > > A quick search of how to install maven on a raspberry pi reveals the most > effective way is a direct install from a download from your site. I.e: > https://www.xianic.net/post/installing-maven-on-the-raspberry-pi/ > I assume many of these users are new developers. However the download link > on your site refers to an INSECURE download, > http://www.mirrorservice.org/sites/ftp.apache.org/maven/maven-3/3.2.5/binaries/apache-maven-3.3.9-bin.tar.gz > followed by the suggestion users should verify the download using md5 (!) or > gpg. > Ignoring the terrible idea of having md5 hashes, about four more steps later > gives the following most unsatisfying gpg result: > gpg --verify apache-maven-3.3.9-bin.tar.gz.asc apache-maven-3.3.9-bin.tar.gz > gpg: Signature made Tue 10 Nov 2015 16:44:20 UTC using DSA key ID BB617866 > gpg: Good signature from "Sarel Jason van Zyl <ja...@maven.org>" > gpg: WARNING: This key is not certified with a trusted signature! > gpg: There is no indication that the signature belongs to the owner. > Primary key fingerprint: FB11 D4BB 7B24 4678 337A AD8B C7BF 26D0 BB61 7866 > So > 1. The CDN should ONLY ALLOW HTTPS. Maven is a core project and allowing for > simple injection at this level is irresponsible. > 2. Providing md5 checksums is irresponsible. How about sha256? This would > allow us to skip all the gpg run-around to vacuous conclusion. > 3. If gpg is the preferred route, then uploads should not be allowed that > does not give a more satisfying answer than "there is no indication the > signature belongs to the owner". I think this falls below the md5 sum bar. > Thank you for providing support to this important project. -- This message was sent by Atlassian JIRA (v6.3.4#6332)