Repository navigation
Implement checksumPolicy for TrustedChecksums to enforce strict version matching - #7510
Open
chrisrueger with Copilot wants to merge 1 commit into
Open
chrisrueger with Copilot wants to merge 1 commit into
chrisrueger with Copilot wants to merge 1 commit into
Conversation
Copilot
AI
changed the title
[WIP] Fix trusted checksums to fail build on new dependencies
Implement checksumPolicy for TrustedChecksums to enforce strict version matching
Oct 29, 2026
Contributor
|
@peterkir Does that look ok for you in principle? |
- Add checksumPolicy configuration property to Configuration interface - Create ChecksumPolicy enum with STRICT and LENIENT modes - Implement policy-based validation in TrustedChecksums - Add setter methods to pass policy to MavenRepository - Initialize policy from configuration in MavenBndRepository - Add comprehensive unit tests for both policy modes - Update package versions (2.4.0->2.5.0 and 2.9.0->2.10.0) Apply checksumPolicy integration to BndPomRepository - Add checksumPolicy() method to PomConfiguration interface - Implement checksumPolicy initialization in BndPomRepository.prepareAsync() - Update package version 2.3.0 -> 2.4.0 Extend docs for checksumPolicy feature in maven.md - Add checksumPolicy property to configuration table - Add new "Checksum Policy" subsection explaining strict vs lenient modes - Update "Expected Behavior" table with policy-specific behaviors - Add configuration examples for both modes - Document use cases for strict mode in production/CI environments add checksumPolicy=strict to examples Signed-off-by: Christoph Rueger <chrisrueger@gmail.com> Co-Authored-By: chrisrueger <188422+chrisrueger@users.noreply.github.com>
chrisrueger
force-pushed
the
copilot/fix-trusted-checksums-failure
branch
from
October 30, 2026 06:28
c6bf785 to
f5fadb9
Compare
chrisrueger
marked this pull request as ready for review
October 30, 2026 06:28
peterkir
approved these changes
Oct 30, 2026
peterkir
left a comment
peterkir
left a comment
Contributor
There was a problem hiding this comment.
Really useful security feature in zero-trust times!
Looks fine for me
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently, TrustedChecksums only validates checksums when entries exist in the .checksums file, allowing builds to pass when a dependency version is updated without corresponding checksum updates. This adds a new
checksumPolicyconfiguration to enforce that all dependencies have matching BSN+version entries.Changes
Configuration & Policy Enum
checksumPolicy()method toConfigurationinterface (default: "lenient")ChecksumPolicyenum withSTRICTandLENIENTmodesTrustedChecksums Validation Logic
checkTrustedChecksum()to enforce policies:TrustedChecksumExceptionwhen .checksums file missing or entry not foundsetChecksumPolicy()andgetChecksumPolicy()methodsMavenRepository & MavenBndRepository Integration
MavenRepository: AddedsetTrustedChecksumsPolicy()to apply policyMavenBndRepository: ReadschecksumPolicyfrom configuration and applies it during initializationTest Coverage
Usage Example
Configure in bnd.bnd or repository configuration:
Backward Compatibility
Default behavior unchanged (lenient mode). Existing configurations continue to work without modification.
Package versions incremented to reflect new APIs:
aQute.bnd.repository.maven.provider(2.4.0→2.5.0) andaQute.maven.provider(2.9.0→2.10.0).