elharo commented on issue #2017: URL: https://github.com/apache/maven-resolver/issues/2017#issuecomment-5116823468
Regarding option 1"Do not place file-lock lock files inside the local repository — use a location that is never treated as content (e.g. a temp/state dir), so consumers can't bundle them." I am increasingly concerned about approaches like this. That is, I don't want my builds to have arbitrary access to the filesystem. If we can keep everything contained within the project directory, that's a better foundation for security work in the future. I'd prefer to just clean up the files if needed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
