Kristian Rickert created OPENNLP-1909:
-----------------------------------------
Summary: General verified installer for user-supplied third-party
resources
Key: OPENNLP-1909
URL: https://issues.apache.org/jira/browse/OPENNLP-1909
Project: OpenNLP
Issue Type: Improvement
Reporter: Kristian Rickert
OpenNLP features increasingly depend on third-party resources that cannot be
bundled (dictionary archives, corpora, lexicons; see LEGAL-732).
PR #1190 and #1191 each grew their own download path during review. This ticket
adds one shared, fail-closed installer: scheme-restricted verified downloads
(SHA-256/512), bounded timeouts, redirects, and size ceilings, byte-based
format detection for tar.gz/zip/gzip with path-escape rejection, staged atomic
installation, and a dependency-free hardened tar reader (checksum-verified
v7/ustar/GNU/pax with long-name support, sparse and global-header rejection).
Existing per-feature download paths can converge on it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
