Re: several security issues with maven

Hello Bear, hello all, IMHO, the final continuous build machine should be anyway a root-only machine (OK, root and the-same-root-person-as-a-common-user). The developer machine is also pretty much a developer-only machine, so there is little concern about some other user fiddling with the files.

RE: Does Jira email this group?

> -Original Message- > From: Ben Walding [mailto:[EMAIL PROTECTED] > Sent: 11 June 2003 23:47 > To: Maven Developers List > Subject: Re: Does Jira email this group? > > JIRA sends email to all maven committers from JIRA. I believe the > mailing list is configured to reject email from no

Re: several security issues with maven

Attached is a quickie implementation of a class loader, if it will help. I didn't touch resource URLs, but an approach I've used with a lot of success in the past is to use a form like jar:/path/to/jarfile?file/within/jarfile That's easy to construct, easy to parse, unique, and not easily c

Re: several security issues with maven

The first issue is the practice of physically unpacking plugin jar files in the $MAVEN_HOME/plugins directly. This requires the directory to be writable by the least privileged user who will run maven - in practice this directory will almost always be world-writable, perhaps with the sticky bit se

several security issues with maven

I've been struggling for the better part of the day to get maven to work... and have identified several critical security issues in the process. N.B., these are so critical that many sysadmins will not only allow maven, they'll disallow anything built with it! (Standard stuff: maven 1.0.b9, binary

cvs commit: maven/src/xsd maven-project.xsd

bwalding2003/06/11 15:30:45 Modified:src/xsd maven-project.xsd Log: Clarify the timezone offset field Revision ChangesPath 1.27 +1 -1 maven/src/xsd/maven-project.xsd Index: maven-project.xsd ===

cvs commit: maven/src/xsd maven-project.xsd

bwalding2003/06/11 15:30:33 Modified:src/xsd maven-project.xsd Log: Clarify the timezone offset field Revision ChangesPath 1.26 +3 -1 maven/src/xsd/maven-project.xsd Index: maven-project.xsd ===

cvs commit: maven/src/plugins-build/jar/src/plugin-resources/templates - New directory

michal 2003/06/11 14:51:30 maven/src/plugins-build/jar/src/plugin-resources/templates - New directory - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]

cvs commit: maven/src/plugins-build/jar/src/plugin-resources/templates manifest.vm

michal 2003/06/11 14:51:38 Modified:src/plugins-build/jar project.xml plugin.jelly Added: src/plugins-build/jar/src/plugin-resources/templates manifest.vm Log: Added dynamic tag library for generation of manifest file Revision ChangesPath

cvs commit: maven/src/plugins-build/jar/src - New directory

michal 2003/06/11 14:51:29 maven/src/plugins-build/jar/src - New directory - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]

cvs commit: maven/src/plugins-build/jar/src/plugin-resources - New directory

michal 2003/06/11 14:51:29 maven/src/plugins-build/jar/src/plugin-resources - New directory - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]

cvs commit: maven project.xml

bwalding2003/06/11 14:49:30 Modified:.project.xml Log: Fixed mailing list archive entries PR: MAVEN-475 Revision ChangesPath 1.277 +2 -2 maven/project.xml Index: project.xml === RC

Re: Does Jira email this group?

JIRA sends email to all maven committers from JIRA. I believe the mailing list is configured to reject email from non-subscribers which is why it doesn't email the list. If someone can confirm or deny that speculation I can reconfigure jira to send to the list. There's no real reason it isn't

Does Jira email this group?

Does Jira actually send notification emails to this mailing list? If I remember correctly, it used to. I just noticed in the email I received that the mailing list email address wasnt present. Was it taken out because it was too noisy - or is the separation deliberate? -Nick This message an

Re: Jelly Bug?

[EMAIL PROTECTED] wrote on 10/06/2003 12:28:53 PM: > > > I am getting the following error with Maven-cvs-head : > > In my maven.xml, I have > > > > > > And I get the error: > > BUILD FAILED > null:37:50: null:34:37: null:164:48: > Replace: source file \entityengine.xml

cvs commit: maven/src/plugins-build/repository/src/plugin-resources repository-audit.xml

dion2003/06/11 07:42:57 Modified:src/plugins-build/repository/src/plugin-resources repository-audit.xml Log: Add mule Revision ChangesPath 1.26 +7 -0 maven/src/plugins-build/repository/src/plugin-resources/repository-audit.xml I

Re: xmlns reference to maven-project.xsd

Is there some sort of recommendation for that in the W3C Schema papers? If there is, let's follow it. Otherwise, we could look at xml files up there on the web and look for common patterns for them. - To unsubscribe, e-mail: [EMA

Re: xmlns reference to maven-project.xsd

Why not http://maven.apache.org/schemas/maven-ver.xsd on the grounds that it would make it possible to list the schemas that are there. Or use an URL in ibiblio, maven repo format: http://www.ibiblio.org/maven/maven/xsds/maven-ver.xsd since that way changes can be deployed with new maven release

Re: xmlns reference to maven-project.xsd

(This was on the user list, I'll finalise our answer before I post back to user list). How about : http://maven.apache.org/maven-ver.xsd eg. http://maven.apache.org/maven-1.0-rc-1.xsd with all the usual bits eg. maven-1.0.xsd for final, maven-1.0-SNAPSHOT.xsd for the "current" version etc.