[
https://issues.apache.org/jira/browse/MNG-7869?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17761795#comment-17761795
]
Tamas Cservenak edited comment on MNG-7869 at 9/4/23 11:51 AM:
---------------------------------------------------------------
No, here are some examples what I mean:
* hashing all JARs that makes the distro (w/o lib/ext) => this would
immediately show if some JARs are replaced in distro
* hading lib/ext, as "empty hash" would mean is empty, other hash would mean
"non empty"
Basically, by having these two we could know if user replaced something in
distro, or installed some extension into lib/ext
Or, simplest: hashing ALL from maven home (by using some plaf independent way
for text files line endings) that would be shown just like current git commit
is.
Purpose is really just to be able to immediately tell, is this "tampered"
(altered as with extension or even JAR replacement) or "vanilla" distro user
uses.
was (Author: cstamas):
No, here are some examples what I mean:
* hashing all JARs that makes the distro (w/o lib/ext) => this would
immediately show if some JARs are replaced in distro
* hading lib/ext, as "empty hash" would mean is empty, other hash would mean
"non empty"
Basically, by having these two we could know if user replaced something in
distro, or installed some extension into lib/ext
Or, simplest: hashing ALL from maven home (by using some plaf independent way
for text files line endings) that would be shown just like current git commit
is.
Purpose is really just to be immediately tell, is this "tampered" or "vanilla"
distro user uses.
> Improve mvn -v output
> ---------------------
>
> Key: MNG-7869
> URL: https://issues.apache.org/jira/browse/MNG-7869
> Project: Maven
> Issue Type: Task
> Reporter: Tamas Cservenak
> Priority: Major
>
> This is really just a dream or wish: would be good if mvn -v (output we
> usually ask from users) would show us more than today, to be able to detect
> like "tampering with resolver" (or replacing it), possible core extensions,
> etc...
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
