paulk-asert opened a new pull request, #2802:
URL: https://github.com/apache/groovy/pull/2802

   The Maven-backed Grape engine resolved with CHECKSUM_POLICY_WARN, so an 
artifact whose published checksum did not match was logged and then added to 
the class loader and had its META-INF services processed. The Ivy-backed engine 
fails resolution in that situation, so the Maven engine silently dropped an 
integrity check that Grape already had.
   
   Resolve with CHECKSUM_POLICY_FAIL instead. Maven Resolver's stock fail 
policy also rejects artifacts that publish no checksum at all, which the Ivy 
engine accepts and which is common for internal and older repositories, so 
install a checksum policy provider that wraps the fail policy and relaxes only 
its onNoMoreChecksums() response. Both engines then behave alike and no 
artifact resolvable today stops resolving.
   
   The disableChecksums opt-out is unchanged: 
@GrabConfig(disableChecksums=true), -Dgroovy.grape.disableChecksums and 
Grape.setDisableChecksums(boolean) all still map to CHECKSUM_POLICY_IGNORE.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to