<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
<div style="color: rgb(0, 0, 0);">
<div>
<div dir="ltr">
<div>Thank you for highlighting this feature!<br>
<br>
It is related to <a href="https://github.com/chains-project/maven-lockfile/" class="OWAAutoLink">
maven-lockfile</a>. Here is a summary of my comparison of the two tools:<br>
<br>
>From my testing I found two main advantages for trusted checksums:<br>
+ It is builtin to maven and require no additional downloads. <br>
+ It captures the checksums of maven plugins that are run (e.g. maven-compiler-plugin, etc).
<br>
<br>
The main uniques features of maven-lockfile:<br>
+ Creates a pom containing specific version of both dependencies and transitive dependencies to download locked versions. This enables re-building the exact same version
<br>
+ Includes essential environment information such as java and maven version<br>
<br>
I think it would be a good idea to combine the tools to enable automatic verification on build/tests. The integrity part of the maven-lockfile is handled very well by trusted checksums. However, the :freeze function of maven-lockfile is missing in trusted-checksum.
If the `pom.xml` contains a version-range and a new version is downloaded the trusted checksums would fail, and there would be quite a lot of manual work to get the project running, especially if it is a transitive dependency that has changed.<br>
<br>
Best,<br>
Elias Lundell<br>
</div>
<br>
<hr style="display:inline-block; width:98%" tabindex="-1">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> rb-general <rb-general-bounces@lists.reproducible-builds.org> on behalf of John Neffenger <john@status6.com><br>
<b>Sent:</b> Friday, September 27, 2024 5:29:36 PM<br>
<b>To:</b> Reproducible Builds List<br>
<b>Subject:</b> Re: release of maven-lockfile</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt">
<div class="PlainText">On 9/27/24 1:20 AM, Martin Monperrus wrote:<br>
> To generate a lock file, run the following command:<br>
> $ mvn io.github.chains-project:maven-lockfile:generate<br>
<br>
I just discovered yesterday that Maven 3.9.2 or later now has support <br>
for dependency and plugin verification built in! It's called "Trusted <br>
Checksums," and it's rather poorly documented for the moment. It's very <br>
similar to how the Gradle dependency verification works.<br>
<br>
There's a demonstration project here:<br>
<br>
Trusted Checksums Demo<br>
<a href="https://github.com/cstamas/tc-demo">https://github.com/cstamas/tc-demo</a><br>
<br>
Some unhelpful Maven documentation is here:<br>
<br>
Trusted Checksums<br>
<a href="https://maven.apache.org/resolver/expected-checksums.html#trusted-checksums">https://maven.apache.org/resolver/expected-checksums.html#trusted-checksums</a><br>
<br>
There's a more helpful Stack Overflow answer here:<br>
<br>
How to use Maven Resolver "Trusted Checksums" to ensure artifact integrity?<br>
<a href="https://stackoverflow.com/q/78746427">https://stackoverflow.com/q/78746427</a><br>
<br>
I added it to my Maven project by setting the following command-line <br>
options in my project's '.mvn/maven.config' file:<br>
<br>
------------------------------------------------------------------------<br>
$ cat .mvn/maven.config<br>
--strict-checksums<br>
-Daether.trustedChecksumsSource.summaryFile=true<br>
-Daether.trustedChecksumsSource.summaryFile.basedir=${session.rootDirectory}/.mvn/checksums/<br>
-Daether.artifactResolver.postProcessor.trustedChecksums=true<br>
-Daether.artifactResolver.postProcessor.trustedChecksums.checksumAlgorithms=SHA-512<br>
-Daether.artifactResolver.postProcessor.trustedChecksums.failIfMissing=true<br>
------------------------------------------------------------------------<br>
<br>
Then I recorded the SHA-512 checksums just once with:<br>
<br>
------------------------------------------------------------------------<br>
$ mvn clean verify <br>
-Daether.artifactResolver.postProcessor.trustedChecksums.record<br>
------------------------------------------------------------------------<br>
<br>
After that, when anyone builds my project, the checksums for all 379 <br>
dependencies and plugins are verified:<br>
<br>
------------------------------------------------------------------------<br>
$ mvn clean package<br>
...<br>
[INFO] Loaded 379 trusted checksums from <br>
/home/john/src/pub/hello-java/.mvn/checksums/checksums-central.sha512<br>
...<br>
[INFO] BUILD SUCCESS<br>
------------------------------------------------------------------------<br>
<br>
John<br>
<br>
</div>
</span></font></div>
</div>
</div>
</body>
</html>