3 ms·
3) This creates an insane MITM opportunity. Not only are they spitting back opaque binaries, but they're doing so by running arbitrary and untrusted user code.
by teacup50 12y ago
3) This creates an insane MITM opportunity.
Not only are they spitting back opaque binaries, but they're doing so by running arbitrary and untrusted user code.
There are already single-command tools for releasing a project to Maven, including tagging the release, bumping the version number in the build file, building and signing the jars, and uploading the results to a Maven repository.
Given that, why would you SaaS trusted builds!?!
- pron 12y agoWell, to be fair, any public Maven repo is a MITM opportunity.
- teacup50 12y agoMaven artifacts can be GPG signed; GPG signing is required for Maven central. It would be irresponsible to use a service like this to build binary JARs that you then signed and uploaded with your own signature guaranteeing their providence.
- jermo 12y agoReleases have to be PGP signed, snapshot's don't. How many people do you know that verify PGP signatures of their artifacts? Do you?
- teacup50 12y agoYes, we verify signatures at our middleware repository cache.
- pron 12y agoReally? Impressive! Where do you get the public keys? Most projects hosted on Maven Central don't publish them on their website.
- teacup50 12y agohttp://blog.sonatype.com/2009/04/nexus-133-introduces-automatic-signature-verification-to-maven-artifacts/ http://blog.sonatype.com/2009/04/nexus-133-introduces-automa...
- pron 12y agoBut unless the signers have a public certificate, or publish their public keys on their website (which you need to obtain manually), the signatures on Maven Central can be just as fake as the artifacts.