gnodet opened a new pull request, #700: URL: https://github.com/apache/maven-deploy-plugin/pull/700
## Summary Applies the remaining 4 LOW/INFO findings from the Glasswing static security audit (scan-maven-deploy-plugin-20260811). All confirmed TP with 5/5 adversarial-panel unanimity. **Stacks on #699** (LOW robustness fixes) → **#698** (MEDIUM security fixes). ### Findings addressed | Finding | Severity | Title | Patch | |---------|----------|-------|-------| | f013 | LOW | Shipped site docs diverge from the Maven-4 code — nonexistent `repositoryLayout`, wagon-era examples | bug_13 | | f014 | LOW | deploy-file coordinate-derivation robustness cluster — hostile-jar handling | bug_14 | | f015 | LOW | Local-repository self-deploy guard is `Path.equals`-only — bypassable | bug_15 | | f016 | INFO | Inverted log message: immediate-deploy branch claims deferral | bug_16 | ### Changes - **f013 (docs-only):** Removed nonexistent `repositoryLayout` parameter from usage/legacy-layout pages; rewrote wagon-era transport guidance; added cleartext warning + encrypted-password example to deploy-ftp page; every new claim verified against `src/main` - **f014:** Swallowed `IOException` during jar POM reading now WARNs; multi-POM (shaded) jars refuse coordinate auto-derivation (fail-closed); temp-POM leak fixed via `pomFromJar` flag; `<3-char` temp prefix crash padded - **f015:** Self-deploy guard now compares real locations (`toRealPath`, falling back to absolute-normalized) instead of textual `Path.equals`, catching `sub/../` respellings and symlinks - **f016:** One-hunk fix for the inverted log at `DeployMojo.java:176-178`: immediate-deploy branch now logs "Deploying <gav>" instead of falsely claiming deferral ### Test plan - [x] All 49 tests pass (36 existing + 13 new across all 3 PRs) - [x] Build verified locally with Maven 4 rc-5 - [x] 4 new hostile-jar robustness tests pass (bug_14) **Audit source:** `scan-maven-deploy-plugin-20260811.zip` 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
