[MNG-5689] Checksum policy for mirrors

• Type: Improvement
• Status: Reopened
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.2.3
• Fix Version/s: Issues to be reviewed for 4.x, wontfix-candidate
• Component/s: Settings
• Labels: security-issue
• Assignee: Unassigned
• Reporter: Christopher Tubbs
• Created: 12/Sep/14 15:27
• Updated: 27/Dec/20 20:40

Description

It does not appear that there is any way to configure a checksum policy for mirrors in the settings.xml file.

In particular, I'd love to enforce a "strict" checksum policy on maven central. I can configure a mirrorOf central, but I cannot set the checksum policy. This seems like a big oversight.

Issue Links

• is related to: MNG-5506 Master override of checksumPolicy
• is related to: MNG-4645 Move Central repo definition out of Maven's jars so it can be more easily changed
• is related to: MNG-5728 Switch the default checksum policy from "warn" to "fail"