Skip to content

Commit ed338e7

Browse files
LogFlamesLogFlames
authored
💬 format: Format all checksums with capital letters (#1255)
1 parent 40d9be9 commit ed338e7

File tree

6 files changed

+32
-30
lines changed

6 files changed

+32
-30
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ mvn -f pom.lockfile.xml
6969
- `includeMavenPlugins` (`-DincludeMavenPlugins=true`) will include the maven plugins in the lockfile. This is useful if you want to validate the Maven plugins as well.
7070
- `allowValidationFailure` (`-DallowValidationFailure=true`, default=false) allow validation failures, printing a warning instead of an error. This is useful if you want to only validate the Maven lockfile, but do not need to fail the build in case the lockfile is not valid. Use with caution, you loose all guarantees.
7171
- `includeEnvironment` (`-DincludeEnvironment=true`) will include the environment metadata in the lockfile. This is useful if you want to have warnings when the environment changes.
72-
- `checksumAlgorithm` (`-DchecksumAlgorithm=sha256`) will set the checksum algorithm used to generate the lockfile. If not explicitly provided it will use SHA-256.
72+
- `checksumAlgorithm` (`-DchecksumAlgorithm=SHA-256`) will set the checksum algorithm used to generate the lockfile. If not explicitly provided it will use SHA-256.
7373
- `checksumMode` will set the checksum mode used to generate the lockfile. See [Checksum Modes](/maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/checksum/ChecksumModes.java) for more information.
7474
- `skip` (`-Dskip=true`) will skip the execution of the plugin. This is useful if you would like to disable the plugin for a specific module.
7575
- `lockfileName` (`-DlockfileName=my-lockfile.json` default="lockfile.json") will set the name of the lockfile file to be generated/read.

‎maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/checksum/ChecksumModes.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@
66
*/
77
public enum ChecksumModes {
88
/**
9-
* Downloads the checksum from the maven repository. Supports md5, sha1, sha256 and sha512. If the requested
9+
* Downloads the checksum from the maven repository. Supports MD5, SHA-1, SHA-256 and SHA-512. If the requested
1010
* checksum is not found in remote repository, the artifact will be downloaded and checksum will be calculated
11-
* on the downloaded artifact. The download will be verified with the sha1 checksum if it available in the remote
11+
* on the downloaded artifact. The download will be verified with the SHA-1 checksum if it available in the remote
1212
* repository.
1313
*/
1414
REMOTE("remote"),

‎maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/checksum/RemoteChecksumCalculator.java‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,12 @@ public RemoteChecksumCalculator(
2626
ProjectBuildingRequest artifactBuildingRequest,
2727
ProjectBuildingRequest pluginBuildingRequest) {
2828
super(checksumAlgorithm);
29-
if (!(checksumAlgorithm.equals("md5")
30-
|| checksumAlgorithm.equals("sha1")
31-
|| checksumAlgorithm.equals("sha256")
32-
|| checksumAlgorithm.equals("sha512"))) {
33-
throw new IllegalArgumentException(
34-
"Invalid checksum algorithm maven central only supports md5, sha1, sha256 or sha512.");
29+
if (!(checksumAlgorithm.equals("MD5")
30+
|| checksumAlgorithm.equals("SHA-1")
31+
|| checksumAlgorithm.equals("SHA-256")
32+
|| checksumAlgorithm.equals("SHA-512"))) {
33+
throw new IllegalArgumentException("Invalid checksum algorithm '" + checksumAlgorithm
34+
+ "', remote repositories only supports MD5, SHA-1, SHA-256 or SHA-512.");
3535
}
3636

3737
this.artifactBuildingRequest = artifactBuildingRequest;
@@ -57,7 +57,8 @@ private Optional<String> calculateChecksumInternal(Artifact artifact, ProjectBui
5757
for (ArtifactRepository repository : buildingRequest.getRemoteRepositories()) {
5858
String artifactUrl = repository.getUrl().replaceAll("/$", "") + "/" + groupId + "/" + artifactId + "/"
5959
+ version + "/" + filename;
60-
String checksumUrl = artifactUrl + "." + checksumAlgorithm;
60+
String checksumUrl =
61+
artifactUrl + "." + checksumAlgorithm.toLowerCase().replace("-", "");
6162

6263
LOGGER.debug("Checking: " + checksumUrl);
6364

@@ -84,7 +85,7 @@ private Optional<String> calculateChecksumInternal(Artifact artifact, ProjectBui
8485
LOGGER.info("Unable to find " + checksumAlgorithm + " checksum for " + artifact.getGroupId() + ":"
8586
+ artifactId + ":" + version + " on remote. Downloading and calculating locally.");
8687

87-
// Fallback to and verify downloaded artifact with sha1
88+
// Fallback to and verify downloaded artifact with SHA-1
8889
HttpRequest artifactVerificationRequest = HttpRequest.newBuilder()
8990
.uri(URI.create(artifactUrl + ".sha1"))
9091
.build();
@@ -103,20 +104,20 @@ private Optional<String> calculateChecksumInternal(Artifact artifact, ProjectBui
103104

104105
if (artifactVerificationResponse.statusCode() >= 200
105106
&& artifactVerificationResponse.statusCode() < 300) {
106-
MessageDigest verificationMessageDigest = MessageDigest.getInstance("sha1");
107+
MessageDigest verificationMessageDigest = MessageDigest.getInstance("SHA-1");
107108
String sha1 = baseEncoding
108109
.encode(verificationMessageDigest.digest(artifactResponse.body()))
109110
.toLowerCase(Locale.ROOT);
110111

111112
if (!sha1.equals(artifactVerification)) {
112-
LOGGER.error("Invalid sha1 checksum for: " + artifactUrl);
113-
throw new RuntimeException("Invalid sha1 checksum for '" + artifact.getGroupId() + ":"
113+
LOGGER.error("Invalid SHA-1 checksum for: " + artifactUrl);
114+
throw new RuntimeException("Invalid SHA-1 checksum for '" + artifact.getGroupId() + ":"
114115
+ artifactId + ":" + version + "'. Checksum found at '" + artifactUrl
115116
+ ".sha1' does not match calculated checksum of downloaded file. Remote checksum = '"
116117
+ artifactVerification + "'. Locally calculated checksum = '" + sha1 + "'.");
117118
}
118119
} else {
119-
LOGGER.warn("Unable to find sha1 to verify download of: " + artifactUrl);
120+
LOGGER.warn("Unable to find SHA-1 to verify download of: " + artifactUrl);
120121
}
121122

122123
MessageDigest messageDigest = MessageDigest.getInstance(checksumAlgorithm);

‎maven_plugin/src/test/java/io/github/chains_project/maven_lockfile/graph/LockfileTest.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ public class LockfileTest {
1111
@Test
1212
void shouldLockFilesEqualWhenOrderIsChanged() {
1313
var metadata = new MetaData(
14-
new Environment("os", "mv", "jv"), new Config(true, false, true, false, "1", "local", "sha1"));
14+
new Environment("os", "mv", "jv"), new Config(true, false, true, false, "1", "local", "SHA-1"));
1515
var groupId = GroupId.of("g");
1616
var artifactId = ArtifactId.of("a");
1717
var version = VersionNumber.of("a");
@@ -42,7 +42,7 @@ private DependencyNode dependencyNodeA(DependencyNode child1, DependencyNode chi
4242
VersionNumber.of("1"),
4343
MavenScope.RUNTIME,
4444
ResolvedUrl.Unresolved(),
45-
"sha1",
45+
"SHA-1",
4646
"A");
4747

4848
node.addChild(child1);
@@ -57,7 +57,7 @@ private DependencyNode dependencyNodeB() {
5757
VersionNumber.of("1"),
5858
MavenScope.RUNTIME,
5959
ResolvedUrl.Unresolved(),
60-
"sha1",
60+
"SHA-1",
6161
"B");
6262
}
6363

@@ -68,7 +68,7 @@ private DependencyNode dependencyNodeAChild1() {
6868
VersionNumber.of("1"),
6969
MavenScope.RUNTIME,
7070
ResolvedUrl.Unresolved(),
71-
"sha1",
71+
"SHA-1",
7272
"1");
7373
}
7474

@@ -79,17 +79,17 @@ private DependencyNode dependencyNodeAChild2() {
7979
VersionNumber.of("1"),
8080
MavenScope.RUNTIME,
8181
ResolvedUrl.Unresolved(),
82-
"sha1",
82+
"SHA-1",
8383
"2");
8484
}
8585

8686
private MavenPlugin pluginA() {
8787
return new MavenPlugin(
88-
GroupId.of("PgA"), ArtifactId.of("PA"), VersionNumber.of("1"), "sha1", "PA", ResolvedUrl.Unresolved());
88+
GroupId.of("PgA"), ArtifactId.of("PA"), VersionNumber.of("1"), "SHA-1", "PA", ResolvedUrl.Unresolved());
8989
}
9090

9191
private MavenPlugin pluginB() {
9292
return new MavenPlugin(
93-
GroupId.of("PgB"), ArtifactId.of("PB"), VersionNumber.of("1"), "sha1", "PB", ResolvedUrl.Unresolved());
93+
GroupId.of("PgB"), ArtifactId.of("PB"), VersionNumber.of("1"), "SHA-1", "PB", ResolvedUrl.Unresolved());
9494
}
9595
}

‎maven_plugin/src/test/java/it/IntegrationTestsIT.java‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -384,14 +384,15 @@ public void remoteRepositoryShouldResolve(MavenExecutionResult result) throws Ex
384384

385385
@MavenTest
386386
public void checksumModeRemote(MavenExecutionResult result) throws Exception {
387-
// contract: if checksum mode is remote, maven-lockfile should be able to download and verify sha256 from maven
388-
// central and if sha256 is not available, it should be able to .
387+
// contract: if checksum mode is remote, maven-lockfile should be able to download and verify SHA-256 from maven
388+
// central and if SHA-256 is not available, it should be able to .
389389
assertThat(result).isSuccessful();
390390
var lockfilePath = findFile(result, "lockfile.json");
391391
assertThat(lockfilePath).exists();
392392
var lockfile = LockFile.readLockFile(lockfilePath);
393393

394-
// Verify: atlassian-bandana:0.2.0 is hosted on packages.atlassian.com which doesn't provide sha256, sha256 has
394+
// Verify: atlassian-bandana:0.2.0 is hosted on packages.atlassian.com which doesn't provide SHA-256, SHA-256
395+
// has
395396
// to be calculated
396397
var dep1Checksum = lockfile.getDependencies().stream()
397398
.filter(dependency -> dependency
@@ -401,18 +402,18 @@ public void checksumModeRemote(MavenExecutionResult result) throws Exception {
401402
assertThat(dep1Checksum).isNotNull();
402403
result.getMavenLog();
403404

404-
// Verify: jsap:2.1 is hosted on repo.maven.apache.org which doesn't provide sha256, and who's sha1 has a
405-
// different format (providing `checksum path` instead of `checksum`). Sha1 should still succeed as the
405+
// Verify: jsap:2.1 is hosted on repo.maven.apache.org which doesn't provide SHA-256, and who's SHA-1 has a
406+
// different format (providing `checksum path` instead of `checksum`). SHA-1 should still succeed as the
406407
// `checksum` is verified aganist up until the first space, thus excluding the path of the file when the
407-
// sha1 was generated. Sha256 has to be calculated.
408+
// SHA-1 was generated. SHA-256 has to be calculated.
408409
var dep2Checksum = lockfile.getDependencies().stream()
409410
.filter(dependency -> dependency
410411
.getChecksum()
411412
.equals("331746fa62cfbc3368260c5a2e660936ad11be612308c120a044e120361d474e"))
412413
.findAny();
413414
assertThat(dep2Checksum).isNotNull();
414415

415-
// Verify: spoon-core:11.1.0 is hosted on maven central and directly provides sha256 checksums
416+
// Verify: spoon-core:11.1.0 is hosted on maven central and directly provides SHA-256 checksums
416417
var dep3Checksum = lockfile.getDependencies().stream()
417418
.filter(dependency -> dependency
418419
.getChecksum()

‎maven_plugin/src/test/resources-its/it/IntegrationTestsIT/checksumModeRemote/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@
5656
</executions>
5757
<configuration>
5858
<checksumMode>remote</checksumMode>
59-
<checksumAlgorithm>sha256</checksumAlgorithm>
59+
<checksumAlgorithm>SHA-256</checksumAlgorithm>
6060
</configuration>
6161
</plugin>
6262
</plugins>

0 commit comments

Comments
 (0)