elharo commented on issue #91: URL: https://github.com/apache/maven-artifact-plugin/issues/91#issuecomment-5847001890
### Identified Problems and Limitations 1. **Scalability and Maintenance of Parameters:** Managing multiple long cryptographic hashes via inline command-line arguments or even plugin configuration blocks in `pom.xml` becomes brittle and hard to read. If a project releases 5 or 6 artifacts (main jar, sources, javadoc, zip distributions, and their signatures), the configuration syntax (`-Dsha512[classifier:extension]=...`) becomes cumbersome. 2. **Duplication with Maven Resolver's Native Capabilities:** Maven Resolver features a built-in **Trusted Checksums** mechanism. Using Maven's core resolver properties (such as `.mvn/maven.config` configurations for `aether.artifactResolver.postProcessor.trustedChecksums`) handles checksum recording and enforcement natively across dependencies and plugins during resolution. A custom plugin goal should clearly delineate whether it targets *local build outputs* (the artifacts just built in the reactor) or *remote dependencies*. Issue #91 aims at verifying the release artifacts being published, but overlapping concerns with core resolver features need architectural alignment. --- ### Recommended Improvements and Changes 1. **Support External Checksum Files:** Instead of forcing users to pass long hash strings via command-line properties, the goal should support reading standard checksum manifest files (such as GNU coreutils-compatible `.sha512` or `.sha256` files, or standard `sha512sum` output formats). A configuration like `-DchecksumFile=project.release.sha512` allows users to check a whole batch of artifacts cleanly against an official release manifest. 2. **Integration with Reactor and Local Output:** Ensure the goal defaults to scanning the current project's primary and attached artifacts built in the reactor (i.e., everything in `target/` scheduled for deployment), eliminating the need to explicitly specify artifact coordinates unless verifying an external dependency. 3. **Fail-Fast and Clear Diagnostic Output:** If a mismatch occurs, the plugin must output a precise diff showing the *expected* checksum versus the *calculated* checksum, alongside the absolute file path of the offending artifact, to simplify debugging in CI/CD pipelines. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
