[
https://issues.apache.org/jira/browse/MRESOLVER-275?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tamás Cservenák updated MRESOLVER-275:
--------------------------------------
Fix Version/s: resolver-next
> Introduce trusted checksums
> ---------------------------
>
> Key: MRESOLVER-275
> URL: https://issues.apache.org/jira/browse/MRESOLVER-275
> Project: Maven Resolver
> Issue Type: Improvement
> Reporter: Tamás Cservenák
> Assignee: Tamás Cservenák
> Priority: Major
> Fix For: resolver-next
>
>
> Provided checksums are introduced as 3rd kind of ChecksumKind (external,
> inlined, provided). But new usses for provided checksums were requested in
> area that is not at all "transport" (connector, transport, artifact download)
> related at all, while {{ProvidedChecksumsSource}} interface is bound to
> "transport" (uses classes from transport).
> Hence, to make a clear distinction, introduce new component: "trusted"
> checksum source, that is generic, is not transport bound and "push" the
> existing implementation below, and adapt "trusted" checksum source into
> "provided" checksum source as needed. This clearly separates notion of
> "provided checksusm (for transport)" from "trusted checksums (usable across
> places not even transport related).
> Note: resolver does NOT do anything for "trust", it is completely up to
> implementation and user, how these checksums are obtained and does user
> trusts them.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
