Merge pull request #857 from ascopes/bugfix/GHSA-j2pc-v64r-mv4f

GHSA-j2pc-v64r-mv4f: Fix digest not being verified for system path protoc

Author: ascopes

protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/protoc/ProtocResolver.java

@@ -88,19 +88,20 @@ public Optional<Path> resolve(
       );
     }
 
+    Optional<Path> path;
+
     if (version.equalsIgnoreCase("PATH")) {
-      return systemPathResolver.resolve(EXECUTABLE_NAME);
+      path = systemPathResolver.resolve(EXECUTABLE_NAME);
+    } else if (version.contains(":")) {
+      path = resolveFromUri(version);
+    } else {
+      path = resolveFromMavenRepositories(version);
     }
 
-    // It is likely a URL, not a version string.
-    var path = version.contains(":")
-        ? resolveFromUri(version)
-        : resolveFromMavenRepositories(version);
-
     if (path.isEmpty()) {
       return Optional.empty();
-
     }
+
     var resolvedPath = path.get();
 
     if (digest != null) {