gnodet opened a new pull request, #698: URL: https://github.com/apache/maven-deploy-plugin/pull/698
## Summary Applies the 6 MEDIUM-severity findings from the Glasswing static security audit (scan-maven-deploy-plugin-20260811) — all confirmed TP with 5/5 adversarial-panel unanimity and zero false positives. ### Findings addressed | Finding | Severity | Title | Patch | |---------|----------|-------|-------| | f001 | MEDIUM | Unvalidated repository-id→URL binding routes arbitrary settings.xml credentials to arbitrary URLs | bug_01 | | f002 | MEDIUM | No transport-scheme validation on any deployment path — cleartext http/ftp accepted silently | bug_02 | | f003 | MEDIUM | deploy-file layout validation incomplete: classifier/types/packaging unvalidated; dot-only coordinates pass | bug_03 | | f004 | MEDIUM | deployAtEnd never transitions to DEPLOYED — re-triggered batch re-publishes the whole reactor | bug_04 | | f005 | MEDIUM | Unsynchronized check-then-act on the batch trigger — `-T` builds can double-fire the batch | bug_05 | | f006 | MEDIUM | deployAtEnd documented fail-closed atomicity is false (three legs) | bug_06 | ### Changes **Cluster 1 — Credential and transport security (f001, f002):** - `validateCredentialBinding`: provenance-aware guard that refuses POM-sourced alt-repo values binding a credentialed id to an unknown URL; CLI-typed values proceed with WARN. New knob: `maven.deploy.allowCredentialReuse` (user-property only, non-POM-bindable) - `validateTransportSecurity`: refuses `http://` and `ftp://` deploy URLs (loopback exempt, `file://` untouched). New knob: `maven.deploy.allowInsecureUrl` - Shipped http doc examples fixed inline **Cluster 2 — Layout validation (f003):** - Shared validators hoisted to `AbstractDeployMojo`: dot-only segments rejected for id/version/classifier/type; classifier/classifiers/types/packaging (previously never validated) now allowlisted in both mojos **Cluster 3 — deployAtEnd state machine (f004, f005, f006):** - `deployAllAtOnce` marks each batched project `State.DEPLOYED` after whole-batch success; re-entry is a logged no-op - `DEPLOY_AT_END_LOCK` monitor serializes the mark-then-check-then-fire sequence across `-T` reactor threads - False atomicity javadoc replaced with accurate non-atomicity enumeration; "(experimental)" removed from the default-on path; partial failure logs ERROR naming repositories already published ### Breaking changes - `http://` and `ftp://` deploy URLs now refused by default (override: `-Dmaven.deploy.allowInsecureUrl=true`) - POM-sourced alt-repo values binding credentials to unknown URLs now refused (override: `-Dmaven.deploy.allowCredentialReuse=true`) - `skip` vocabulary is now fail-closed: unrecognized values (typos, wrong case) fail the build instead of silently deploying ### Test plan - [x] All 36 existing tests pass - [x] 3 new provenance-aware credential tests pass (bug_01) - [x] 3 new transport security tests pass (bug_02) - [x] New deployAtEnd re-deploy test passes (bug_04) - [x] Build verified locally with Maven 4 rc-5 **Audit source:** `scan-maven-deploy-plugin-20260811.zip` — 5-researcher static audit, 80/80 adversarial-panel votes, 0 FP 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
