[
https://issues.apache.org/jira/browse/GROOVY-12265?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105409#comment-18105409
]
ASF GitHub Bot commented on GROOVY-12265:
-----------------------------------------
paulk-asert opened a new pull request, #2802:
URL: https://github.com/apache/groovy/pull/2802
The Maven-backed Grape engine resolved with CHECKSUM_POLICY_WARN, so an
artifact whose published checksum did not match was logged and then added to
the class loader and had its META-INF services processed. The Ivy-backed engine
fails resolution in that situation, so the Maven engine silently dropped an
integrity check that Grape already had.
Resolve with CHECKSUM_POLICY_FAIL instead. Maven Resolver's stock fail
policy also rejects artifacts that publish no checksum at all, which the Ivy
engine accepts and which is common for internal and older repositories, so
install a checksum policy provider that wraps the fail policy and relaxes only
its onNoMoreChecksums() response. Both engines then behave alike and no
artifact resolvable today stops resolving.
The disableChecksums opt-out is unchanged:
@GrabConfig(disableChecksums=true), -Dgroovy.grape.disableChecksums and
Grape.setDisableChecksums(boolean) all still map to CHECKSUM_POLICY_IGNORE.
> GrapeMaven: fail resolution on checksum mismatch
> ------------------------------------------------
>
> Key: GROOVY-12265
> URL: https://issues.apache.org/jira/browse/GROOVY-12265
> Project: Groovy
> Issue Type: Improvement
> Components: Grape
> Reporter: Paul King
> Priority: Major
>
> The default of mismatch failing by default should be similar to Ivy. Maven
> would also fail when no checksums are present whereas Ivy only fails for a
> bad checksum.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
