gnodet opened a new pull request, #2083: URL: https://github.com/apache/maven-resolver/pull/2083
## Summary Fixes 3 findings from the maven-resolver security audit (scan-maven-resolver-20260811): | Finding | Severity | Description | |---------|----------|-------------| | f007 | MEDIUM | Windows final move is truncate-and-copy, not atomic; truncated artifact can survive as trusted | | f020 | LOW | IPC lock daemon protocol is unauthenticated; bootstrap secret leaks via argv | | f025 | LOW | IPC lock key digest concatenates names without separators | **Root cause:** The concurrency layer has spots where its own guarantee is violated: Windows publication is not atomic, and the IPC lock daemon trusts every connection and digests keys ambiguously. **Fix:** Atomic rename on Windows with retry, authenticated IPC daemon with SecureRandom tokens and peer credentials, unambiguous length-prefixed key digest. ## Test plan - [ ] Existing tests pass - [ ] Windows atomic move tested - [ ] IPC daemon authentication tested - [ ] Key digest uniqueness tested 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
