[
https://issues.apache.org/jira/browse/MBUILDCACHE-86?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17839399#comment-17839399
]
ASF GitHub Bot commented on MBUILDCACHE-86:
-------------------------------------------
kbuntrock commented on PR #104:
URL:
https://github.com/apache/maven-build-cache-extension/pull/104#issuecomment-2068086415
> Hi, @kbuntrock @hboutemy. This PR looks good. How can we move it from a
draft to an open state?
Hello @AlexanderAshitkin. I guess this PR needs now a bit of "huile de
coude" like we say in France ("elbow oil" ...). Meaning that I have to work. 😊
In details, I need to :
- take into account your reviews
- update the documentation
- add some tests
> Bugfix and enhancements with the restoration of outputs on disk
> ---------------------------------------------------------------
>
> Key: MBUILDCACHE-86
> URL: https://issues.apache.org/jira/browse/MBUILDCACHE-86
> Project: Maven Build Cache Extension
> Issue Type: Improvement
> Reporter: Kevin Buntrock
> Priority: Major
> Labels: pull-request-available
>
> *Fixes :*
> * Files containing an underscore in their name can't be restored in the
> cache directory correctly (not in the same directory location).
> * The cache is able to extract/restore files in locations outside the
> project. I guess the extraction part is not a vulnerability since someone
> with commit permissions can guess other ways to extract data. But the
> possibility of restoring at any place on the disk looks pretty dangerous to
> me if a remote cache server is compromised.
> *Enhancements :*
> * Possibility to restore artefacts on disk, with a dedicated property :
> maven.build.cache.restoreOnDiskArtefacts (default to true). Meaning in the
> project directory, as opposed to the cache directory.
> ** IDE integration and use of the cache locally in developement is way
> easier. It is now possible to retrieve a cached jar in the "target" directory.
> * Introduce "globs" to filter extra attached outputs by filenames.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
