This is an automated email from the ASF dual-hosted git repository. gnodet pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/maven-resolver.git
commit 4fa61b8b38732ce9f578762a10b3c77f2eef4117 Author: Guillaume Nodet <[email protected]> AuthorDate: Sun Jun 7 07:08:59 2026 +0000 Fix GnupgSignatureArtifactGenerator — use CopyOnWriteArrayList F-35: Replace plain ArrayList with CopyOnWriteArrayList for signatureTempFiles as a defensive measure against potential concurrent access between generate() and close(). --- .../aether/generator/gnupg/GnupgSignatureArtifactGenerator.java | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/GnupgSignatureArtifactGenerator.java b/maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/GnupgSignatureArtifactGenerator.java index d7a8d62c0..17d0564df 100644 --- a/maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/GnupgSignatureArtifactGenerator.java +++ b/maven-resolver-generator-gnupg/src/main/java/org/eclipse/aether/generator/gnupg/GnupgSignatureArtifactGenerator.java @@ -27,6 +27,8 @@ import java.nio.file.Path; import java.util.ArrayList; import java.util.Collection; import java.util.Collections; +import java.util.List; +import java.util.concurrent.CopyOnWriteArrayList; import java.util.function.Predicate; import org.bouncycastle.bcpg.ArmoredOutputStream; @@ -54,7 +56,7 @@ final class GnupgSignatureArtifactGenerator implements ArtifactGenerator { private final PGPPrivateKey privateKey; private final PGPSignatureSubpacketVector hashSubPackets; private final String keyInfo; - private final ArrayList<Path> signatureTempFiles; + private final List<Path> signatureTempFiles; GnupgSignatureArtifactGenerator( Collection<Artifact> artifacts, @@ -69,7 +71,7 @@ final class GnupgSignatureArtifactGenerator implements ArtifactGenerator { this.privateKey = privateKey; this.hashSubPackets = hashSubPackets; this.keyInfo = keyInfo; - this.signatureTempFiles = new ArrayList<>(); + this.signatureTempFiles = new CopyOnWriteArrayList<>(); logger.debug("Created generator using key {}", keyInfo); }
