3 ms·
That's interesting, doesn't Maven offer a checksum option to begin with? I feel like just the other day, someone was saying "who ever uses checksums anyway," bu
by shortstuffsushi 12y ago
That's interesting, doesn't Maven offer a checksum option to begin with? I feel like just the other day, someone was saying "who ever uses checksums anyway," but a package manager run over insecure methods seems like the perfect time to do so.
- mike_hearn 12y agoFor bitcoinj we developed a similar plugin for Maven: https://github.com/gary-rowe/BitcoinjEnforcerRules https://github.com/gary-rowe/BitcoinjEnforcerRules
- yourad_io 12y agoFrom the article: > When JARs are downloaded from Maven Central, they go over HTTP, so a man in the middle proxy can replace them at will. It’s possible to sign jars, but in my experimentation with standard tools, these signatures aren’t checked. The only other verification is a SHA1 sum, which is also sent over HTTP.
- shortstuffsushi 12y agoI agree that they aren't checked by default, you'd need to implement it (as the parent commenter seemed to be doing with their gradle plugin). Regarding the sums being sent over HTTP as well, seems that you'll need a checksum for your checksum. Ultimately, though, it just seems that it'd be best to avoid this while it's over HTTP.