[MRESOLVER-275] Introduce trusted checksums source - ASF JIRA

Agile Board

Attach files

Attach Screenshot

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: New Feature
Status: Closed
Priority: Major
Resolution: Fixed
Affects Version/s: None
Fix Version/s: 1.9.0
Component/s: Resolver
Labels:
None

Description

Provided checksums are introduced as 3rd kind of ChecksumKind (external, inlined, provided). But new usses for provided checksums were requested in area that is not at all "transport" (connector, transport, artifact download) related at all, while ProvidedChecksumsSource interface is bound to "transport" (uses classes from transport).

Hence, to make a clear distinction, introduce new component: "trusted" checksum source, that is generic, is not transport bound and "push" the existing implementation below, and adapt "trusted" checksum source into "provided" checksum source as needed. This clearly separates notion of "provided checksusm (for transport)" from "trusted checksums (usable across places not even transport related).

Note: resolver does NOT do anything for "trust", it is completely up to implementation and user, how these checksums are obtained and does user trusts them.