cstamas opened a new pull request, #2238: URL: https://github.com/apache/maven-resolver/pull/2238
Four cases where the enhanced local repository manager accepted a cached artifact it should not have: - The same-id-different-URL fallback in applyTracking matched any tracking entry starting with "<id>-". An artifact tracked for "central-snapshots" (ID-only or URL-qualified) was accepted for a request to "central". The rest of the key must now be exactly one SHA-1 hash. - add() with a remote repository and null/empty contexts wrote no tracking entry. The untracked file was then accepted as locally installed. It now records the entry under an empty context. - NamedLocksTrackingFileManager.update truncated the tracking file before rewriting it. A crash mid-write left an empty file, and every artifact in that directory then looked untracked. It now writes a collocated temp file and atomically moves it into place. - LegacyTrackingFileManager.read treated an unreadable tracking file as missing, so the artifact looked untracked. It now checks only for existence, so an access error throws. Each case has a test that fails without the fix. --- To make clear that you license your contribution under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0) check one of the following: - [ ] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0) - [x] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
