gnodet opened a new pull request, #445: URL: https://github.com/apache/maven-install-plugin/pull/445
## Summary Hardens the `installAtEnd` integrity contracts in `InstallMojo`, addressing two findings from a static security audit. No adversary steers these — they are reported because the plugin's own javadoc promises an all-or-nothing property the code does not enforce, and the deviation lands in the trusted-on-arrival shared local repository. ### Findings addressed | ID | Severity | Title | |---|---|---| | f005 | LOW | installAtEnd all-or-nothing contract broken by mid-loop failure | | f006 | LOW | installAtEnd trigger is unsynchronized check-then-act under parallel builds | ### Changes - **Plugin matching (f005):** `usingPlugin()` now groups reactor projects by plugin presence (any execution not bound to phase `none`) instead of exact execution-id equality. A module binding the goal under a custom id can no longer observe a singleton project set, trivially satisfy `allProjectsMarked`, and install mid-build. - **Partial-install inventory (f005):** On a mid-loop deferred-install failure, an explicit ERROR inventory of installed / failed / not-installed projects is logged before rethrowing. - **Javadoc correction (f005):** The `installAtEnd` javadoc is updated to state the actual guarantee. - **Exactly-once trigger (f006):** The mark-check-fire sequence is wrapped in a `synchronized` block (static lock shared across reactor threads). Each project transitions `TO_BE_INSTALLED → INSTALLED` inside the loop, so a concurrent or repeated trigger skips completed work. ### Category **Integrity hardening** — no adversary, no live exploit. The documented all-or-nothing contract is now enforced. ## Test plan - [ ] `usingPluginMatchesAnyExecutionId` — custom execution id is recognized - [ ] `usingPluginIgnoresExecutionsBoundToNone` — phase `none` is excluded - [ ] `midLoopFailureLogsPartialInstallInventory` — explicit inventory logged on failure - [ ] `deferredInstallRunsExactlyOncePerProject` — second `execute()` call does not re-install - [ ] Existing tests pass unchanged - [ ] `mvn clean install -B` succeeds 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
