Description
Provided checksums are introduced as 3rd kind of ChecksumKind (external, inlined, provided). But new usses for provided checksums were requested in area that is not at all "transport" (connector, transport, artifact download) related at all, while ProvidedChecksumsSource interface is bound to "transport" (uses classes from transport).
Hence, to make a clear distinction, introduce new component: "trusted" checksum source, that is generic, is not transport bound and "push" the existing implementation below, and adapt "trusted" checksum source into "provided" checksum source as needed. This clearly separates notion of "provided checksusm (for transport)" from "trusted checksums (usable across places not even transport related).
Note: resolver does NOT do anything for "trust", it is completely up to implementation and user, how these checksums are obtained and does user trusts them.
Attachments
Issue Links
- relates to
-
MRESOLVER-279 Simplify and improve trusted checksum sources
-
- Closed
-