[
https://issues.apache.org/jira/browse/OPENNLP-1909?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Richard Zowalla closed OPENNLP-1909.
------------------------------------
Fix Version/s: 3.0.0-M6
3.0.0
Resolution: Fixed
> General verified installer for user-supplied third-party resources
> -------------------------------------------------------------------
>
> Key: OPENNLP-1909
> URL: https://issues.apache.org/jira/browse/OPENNLP-1909
> Project: OpenNLP
> Issue Type: Improvement
> Reporter: Kristian Rickert
> Assignee: Kristian Rickert
> Priority: Major
> Fix For: 3.0.0-M6, 3.0.0
>
> Time Spent: 1h 40m
> Remaining Estimate: 0h
>
> OpenNLP features increasingly depend on third-party resources that cannot be
> bundled (dictionary archives, corpora, lexicons; see LEGAL-732).
> PR #1190 and #1191 each grew their own download path during review. This
> ticket adds one shared, fail-closed installer: scheme-restricted verified
> downloads (SHA-256/512), bounded timeouts, redirects, and size ceilings,
> byte-based format detection for tar.gz/zip/gzip with path-escape rejection,
> staged atomic installation, and a dependency-free hardened tar reader
> (checksum-verified v7/ustar/GNU/pax with long-name support, sparse and
> global-header rejection). Existing per-feature download paths can converge on
> it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
