gnodet commented on code in PR #2080:
URL: https://github.com/apache/maven-resolver/pull/2080#discussion_r3893116443
##########
maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/DefaultArtifactResolver.java:
##########
@@ -119,6 +119,23 @@ public class DefaultArtifactResolver implements
ArtifactResolver {
public static final boolean DEFAULT_SIMPLE_LRM_INTEROP = false;
+ /**
+ * Configuration to restore the legacy "existence check" behavior for
artifacts that are present in the local
+ * repository but were cached from a remote repository unavailable in the
current build context: when enabled, a
+ * bare remote existence check (no content transfer, hence no checksum
validation) suffices to re-label the cached
+ * bytes as originating from the queried repository. When disabled (the
default), the artifact is downloaded again
+ * through the regular transfer path, so the content is validated against
the repository's checksum policy before
+ * it is registered with the local repository for that repository.
Enabling this trades integrity for bandwidth
+ * and is warmly recommended to leave it disabled.
+ *
+ * @configurationSource {@link
RepositorySystemSession#getConfigProperties()}
+ * @configurationType {@link java.lang.Boolean}
+ * @configurationDefaultValue {@link #DEFAULT_EXISTENCE_CHECK_RELABEL}
+ */
+ public static final String CONFIG_PROP_EXISTENCE_CHECK_RELABEL =
CONFIG_PROPS_PREFIX + "existenceCheckRelabel";
Review Comment:
Good question. They address different interop paths:
**`simpleLrmInterop`** (existing): when an artifact file exists locally but
has **no tracking file at all** (installed by a simple LRM), this flag tells
the enhanced LRM to accept it and retroactively create tracking. It's about
untracked files → tracked.
**`existenceCheckRelabel`** (new, finding f005): when an artifact is
**tracked but from a different remote repository** (unavailable in the current
build), the old code does a bare HEAD request to another remote repo — if the
file exists there, it re-labels the tracking to that repo *without downloading
or checksumming the content*. This is the re-labeling vulnerability: cached
bytes from repo A get stamped as verified-from-repo B without any content
validation.
The new flag defaults to `false`, forcing a full download+checksum through
the regular transfer path when the repository context doesn't match. The
`simpleLrmInterop` flag remains orthogonal — it handles the no-tracking-file
case, not the wrong-tracking case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
