Re: Ensuring artifact integrity with artifact pinning

Thanks for the pointers. It's also worth noting that Google's build tool Bazel allows users to list an artifact sha1 as part of the artifact definition, although it's not particularly automated. They consider it important: "It is a security risk to omit the SHA-1 as remote files can change."

Maven-generated sites for multiple supported versions?

How would one generate a site that provides access to multiple versions of the documentation? Is there standard support for such a thing, or a known plugin? - To unsubscribe, e-mail: users-unsubscr...@maven.apache.org For

Re: Repository authentication when directly invoking dependency plugin

Hello. Right, somebody answered my SO as well, suggesting that. However, I am not even using pom.xml, I am providing the repository definition directly into the plugin, as a property (from the command line), and there is no "current" pom.xml file. Is there a reason why the authentication settings

Re: Ensuring artifact integrity with artifact pinning

It’s an idea I also started a while back, but the problem is, it is not really a good security as long as you do the checksum Test before executing any plugins, which is a bit hard to do. You find some older sample code here https://github.com/ecki/lockdep-maven-plugin Gruss Bernd --

Re: Ensuring artifact integrity with artifact pinning

Hi, seems related to MNG-6026[1]. thanks, Robert [1] https://issues.apache.org/jira/browse/MNG-6026 On Tue, 20 Nov 2018 12:26:54 +0100, Andrew Todd wrote: Hello all, I am considering writing a Maven plugin to help improve confidence in the integrity of the Maven artifacts used by a

Re: Reusing common plugin configuration in pom's having different parents

See https://issues.apache.org/jira/browse/MNG-5588 thanks, Robert On Tue, 20 Nov 2018 15:25:35 +0100, Neeraj Mahajan wrote: Hi , Does anyone know if we have a feature in maven to reuse common plugin configuration in projects that doesn't share common parent ? I know in case of

Re: Repository authentication when directly invoking dependency plugin

Hi Pawel, The repositories defined in pom.xml is used for uploading artifacts. However in order to download artifacts from the same repository you need to add the repository to the profile section of settings.xml. Hope this helps. Kind Regards, Neeraj Mahajan On Tue, Nov 20, 2018 at 12:59 PM

Reusing common plugin configuration in pom's having different parents

Hi , Does anyone know if we have a feature in maven to reuse common plugin configuration in projects that doesn't share common parent ? I know in case of dependencies we have an *import *scope which we can use in dependency management section to import dependencies defined in other pom file.

Repository authentication when directly invoking dependency plugin

Hello. I have a private Maven repository. It's defined in pom.xml of the project some.id https://some.host/artifactory/some.id In my ~/.m2/settings.xml, I have a proper authentication block: some.id pawel.vese...@domain.com

Ensuring artifact integrity with artifact pinning

Hello all, I am considering writing a Maven plugin to help improve confidence in the integrity of the Maven artifacts used by a project. I'm looking for feedback on this idea before I start working on it, hopefully this winter. Here's a brief overview of what I have in mind. Maven, like many