gnodet opened a new pull request, #2080: URL: https://github.com/apache/maven-resolver/pull/2080
## Summary Fixes 5 findings from the maven-resolver security audit (scan-maven-resolver-20260811): | Finding | Severity | Description | |---------|----------|-------------| | f005 | MEDIUM | Existence-check peek re-labels cached foreign-repo bytes without checksum verification | | f006 | MEDIUM | Snapshot-normalized copy is untracked and later treated as locally installed | | f013 | MEDIUM | Repo-id-only keying lets wire-injected repository poison shared local repo | | f019 | MEDIUM | Case-colliding coordinates poison distinct GAVs on case-insensitive filesystems | | f021 | LOW | Stale tracking-file cache flips repo-id rejection into local-install acceptance | **Root cause:** The enhanced local repository manager's availability decision rests on tracking state that can be weaker than the file it judges: fail-open interop branch, id-only tracking keys, case-insensitive filesystem aliasing, and re-labeling without verification. **Fix:** Make trust labels earned and identity-bound: require verification before re-labeling, bind tracking keys to URLs, use filesystem-faithful comparison, invalidate cache after writes. ## Test plan - [ ] Existing tests pass - [ ] Trust re-labeling requires checksum verification - [ ] Snapshot normalization tracking validated - [ ] Case-collision handling tested 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
