[
https://issues.apache.org/jira/browse/MRESOLVER-269?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17613207#comment-17613207
]
ASF GitHub Bot commented on MRESOLVER-269:
------------------------------------------
cstamas commented on code in PR #199:
URL: https://github.com/apache/maven-resolver/pull/199#discussion_r986063529
##########
maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/checksum/SparseFileTrustedChecksumsSource.java:
##########
@@ -0,0 +1,125 @@
+package org.eclipse.aether.internal.impl.checksum;
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import javax.inject.Inject;
+import javax.inject.Named;
+import javax.inject.Singleton;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.eclipse.aether.RepositorySystemSession;
+import org.eclipse.aether.artifact.Artifact;
+import org.eclipse.aether.internal.impl.LocalPathComposer;
+import org.eclipse.aether.repository.ArtifactRepository;
+import org.eclipse.aether.spi.connector.checksum.ChecksumAlgorithmFactory;
+import org.eclipse.aether.spi.io.FileProcessor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import static java.util.Objects.requireNonNull;
+
+/**
+ * Sparse file {@link FileTrustedChecksumsSourceSupport} implementation that
use specified directory as base
+ * directory, where it expects artifacts checksums on standard Maven2 "local"
layout. This implementation uses Artifact
+ * coordinates solely to form path from basedir, pretty much as Maven local
repository does.
+ * <p>
+ * The source may be configured to be "origin aware", in that case it will
factor in origin repository ID as well into
+ * base directory name (for example ".checksums/central/...").
Review Comment:
It can, but I tend to NOT make it 100% same for several reasons:
* if we'd use LocalPathPrefixComposer, then if you use split LRM you MUST
use split (originAware) SparseDirectory as well. So it's both or nothing.
* given we want to distinguish here the ORIGIN of checksums, I would even
lessen the "resemblency" to local repo (to not have anyone "tempted" to just
copy the hashes from his local repo for example)
* both (non origin aware and origin aware) has it's "pros": one can ship
"curated" checksums per project (non-origin aware), or one can ship "curated"
checksum per repo
##########
maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/checksum/SparseFileTrustedChecksumsSource.java:
##########
@@ -0,0 +1,125 @@
+package org.eclipse.aether.internal.impl.checksum;
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import javax.inject.Inject;
+import javax.inject.Named;
+import javax.inject.Singleton;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.eclipse.aether.RepositorySystemSession;
+import org.eclipse.aether.artifact.Artifact;
+import org.eclipse.aether.internal.impl.LocalPathComposer;
+import org.eclipse.aether.repository.ArtifactRepository;
+import org.eclipse.aether.spi.connector.checksum.ChecksumAlgorithmFactory;
+import org.eclipse.aether.spi.io.FileProcessor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import static java.util.Objects.requireNonNull;
+
+/**
+ * Sparse file {@link FileTrustedChecksumsSourceSupport} implementation that
use specified directory as base
+ * directory, where it expects artifacts checksums on standard Maven2 "local"
layout. This implementation uses Artifact
+ * coordinates solely to form path from basedir, pretty much as Maven local
repository does.
+ * <p>
+ * The source may be configured to be "origin aware", in that case it will
factor in origin repository ID as well into
+ * base directory name (for example ".checksums/central/...").
Review Comment:
It can, but I tend to NOT make it 100% same for several reasons:
* ~~if we'd use LocalPathPrefixComposer, then if you use split LRM you MUST
use split (originAware) SparseDirectory as well. So it's both or nothing~~ I
feel I don't quite understand your proposal
* given we want to distinguish here the ORIGIN of checksums, I would even
lessen the "resemblency" to local repo (to not have anyone "tempted" to just
copy the hashes from his local repo for example)
* both (non origin aware and origin aware) has it's "pros": one can ship
"curated" checksums per project (non-origin aware), or one can ship "curated"
checksum per repo
##########
maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/checksum/SparseFileTrustedChecksumsSource.java:
##########
@@ -0,0 +1,125 @@
+package org.eclipse.aether.internal.impl.checksum;
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import javax.inject.Inject;
+import javax.inject.Named;
+import javax.inject.Singleton;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.eclipse.aether.RepositorySystemSession;
+import org.eclipse.aether.artifact.Artifact;
+import org.eclipse.aether.internal.impl.LocalPathComposer;
+import org.eclipse.aether.repository.ArtifactRepository;
+import org.eclipse.aether.spi.connector.checksum.ChecksumAlgorithmFactory;
+import org.eclipse.aether.spi.io.FileProcessor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import static java.util.Objects.requireNonNull;
+
+/**
+ * Sparse file {@link FileTrustedChecksumsSourceSupport} implementation that
use specified directory as base
+ * directory, where it expects artifacts checksums on standard Maven2 "local"
layout. This implementation uses Artifact
+ * coordinates solely to form path from basedir, pretty much as Maven local
repository does.
+ * <p>
+ * The source may be configured to be "origin aware", in that case it will
factor in origin repository ID as well into
+ * base directory name (for example ".checksums/central/...").
Review Comment:
IMHO nope, partially due that above ("lessen the resemblency to LRM"), and
partially as these are "trusted checksums" ONLY (that may or may not have
origin noted), while "split repository" is, well, as it's name say a
"repository", that again implies layout and contents (artifacts, not
checksums). Plus, then we'd have a "repository embedded within repository", as
`$LOCAL_REPO/.splitRepository` would imply that, no?
##########
maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/checksum/SparseFileTrustedChecksumsSource.java:
##########
@@ -0,0 +1,125 @@
+package org.eclipse.aether.internal.impl.checksum;
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import javax.inject.Inject;
+import javax.inject.Named;
+import javax.inject.Singleton;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.eclipse.aether.RepositorySystemSession;
+import org.eclipse.aether.artifact.Artifact;
+import org.eclipse.aether.internal.impl.LocalPathComposer;
+import org.eclipse.aether.repository.ArtifactRepository;
+import org.eclipse.aether.spi.connector.checksum.ChecksumAlgorithmFactory;
+import org.eclipse.aether.spi.io.FileProcessor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import static java.util.Objects.requireNonNull;
+
+/**
+ * Sparse file {@link FileTrustedChecksumsSourceSupport} implementation that
use specified directory as base
+ * directory, where it expects artifacts checksums on standard Maven2 "local"
layout. This implementation uses Artifact
+ * coordinates solely to form path from basedir, pretty much as Maven local
repository does.
+ * <p>
+ * The source may be configured to be "origin aware", in that case it will
factor in origin repository ID as well into
+ * base directory name (for example ".checksums/central/...").
Review Comment:
IMHO nope, partially due that above ("lessen the resemblency to LRM"), and
partially as these are "trusted checksums" ONLY (that may or may not have
origin noted), while "split repository" is, well, as it's name say a
"repository", that again implies layout and contents (artifacts, not checksums).
> Allow more compact storage of provided checksums
> ------------------------------------------------
>
> Key: MRESOLVER-269
> URL: https://issues.apache.org/jira/browse/MRESOLVER-269
> Project: Maven Resolver
> Issue Type: Improvement
> Components: Resolver
> Reporter: Rafael Winterhalter
> Assignee: Tamás Cservenák
> Priority: Major
> Fix For: resolver-next
>
>
> While the repository layout makes sense for storage outside of a project, it
> would be more convenient to store checksums in a single file (per algorithm)
> when keeping checksums along when storing these checksums within a project.
> This makes the storage easier to version control and avoids the overhead of
> storing a lot of files in version control what often creates some overhead.
> Ideally, Maven could support such files out of the box by shipping a provider
> for such files.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
