[MNG-5728] Switch the default checksum policy from "warn" to "fail"

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.6.3
• Fix Version/s: 4.0.0-alpha-2, 4.0.0
• Component/s: Artifacts and Repositories
• Assignee: Robert Scholte
• Reporter: Nicolas Juneau
• Created: 27/Nov/14 15:54
• Updated: 20/Oct/22 08:11
• Resolved: 02/Dec/20 19:54

Description

The default checksum policy when obtaining artifacts during a build is currently, by default, "warn". This seems a bit odd for me since a checksum is usually used to prevent the use of corrupted data.

Since Maven produces a lot of output (and some IDEs sometimes hide it), it is easy to miss a bad checksum warning. I am aware that there is a checksumPolicy setting in Maven, but, unless I am mistaken, it cannot be defined for all repositories at once. It has to be done either on a per-repository basis or by using the "strict-checksum" flag in the command line.

After searching around a bit on the Web and with the help of a coworker, we discovered that the default "warn" setting was mainly there because some repositories were not handling checksums quite well. Issue MNG-339 contains some information about this.

My colleague also chatted briefly with "trygvis" on IRC. Apparently, the default "warn" setting is really there for historical reasons.

I believe that a default value of "fail" would greatly reduce the likelihood of errors and also slightly increase the security of Maven. Corrupted artifacts should not, by default, be used for builds.

Issue Links

• is duplicated by: MNG-6422 Maven by default does not check checksums; Maven lacks reproducible builds capability
• relates to: MNG-5689 Checksum policy for mirrors
• relates to: MRESOLVER-151 Enforce a checksum policy to be provided explicitly
• links to: GitHub Pull Request #36
• links to: GitHub Pull Request #84
• links to: GitHub Pull Request #405
• links to: GitHub Pull Request #407