✨ feat(checksum calculator): Add cache to remote checksum calculator

[LogFlames]

Adds cache to remote checksum calculator. Part of solution for #1476.

Reduces time to generate lockfile for maven-lockfile in remote mode (plugins included) from:

[INFO] maven-lockfile-parent .............................. SUCCESS [08:18 min]
[INFO] maven-lockfile-plugin .............................. SUCCESS [12:01 min]

To

[INFO] maven-lockfile-parent .............................. SUCCESS [02:21 min]
[INFO] maven-lockfile-plugin .............................. SUCCESS [02:26 min]

[LogFlames]

@algomaster99 would love a review! Quite low hanging apple in terms of speedup to complexity ratio

[Copilot]

Pull request overview

This PR adds caching functionality to the RemoteChecksumCalculator to significantly improve performance when generating lockfiles in remote mode. The change addresses issue #1476, which reported extremely slow execution times (around 20 minutes) when generating lockfiles with remote checksums. According to the PR description, the implementation reduces lockfile generation time from approximately 20 minutes to around 5 minutes by caching previously fetched checksums and repository information.

Changes:

• Added two ConcurrentHashMap caches to store checksums and repository information
• Implemented cache lookup logic in both checksum calculation and repository resolution methods
• Cache uses artifact coordinates as keys and stores empty strings/sentinel values for failed lookups

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[algomaster99]

The cache implemented here is useful if we compute checksum of a dependency multiple times. For example, we can see maven-artifact duplicated multiple times - 1 and 2. The issue mentions that it is slow because of sequential computation, which is not handled at least in the changes.

I suggest computing performance improvement over spoon just to know what actually is slowing down remote checksum calculator.

[LogFlames]

I will run tests over spoon, my plan is to implement parallel connections in another PR to separate the functionality.

Adding parallellism introduces quite a bit of complexity so I thought it would be a good idea to start with this easier change which already gets huge improvements.

[LogFlames]

Here are my spoon tests.

Without caching:

[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  13:46 min
[INFO] Finished at: 2026-01-29T13:54:29+01:00
[INFO] ------------------------------------------------------------------------

With caching:

[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  01:28 min
[INFO] Finished at: 2026-01-29T14:00:17+01:00
[INFO] ------------------------------------------------------------------------

[algomaster99]

Oh this is very nice!

Adding parallellism introduces quite a bit of complexity so I thought it would be a good idea to start with this easier change which already gets huge improvements.

Sounds good, although 1 minute is also not too bad :)

[algomaster99]

Here are my spoon tests.

Without caching:

[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  13:46 min
[INFO] Finished at: 2026-01-29T13:54:29+01:00
[INFO] ------------------------------------------------------------------------

With caching:

[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  01:28 min
[INFO] Finished at: 2026-01-29T14:00:17+01:00
[INFO] ------------------------------------------------------------------------

@LogFlames could you share the exact command to reproduce this? I feel mvn io.github.chains-project:maven-lockfile:5.13.0:generate is not it.

Even with mvn io.github.chains-project:maven-lockfile:5.13.0:generate -DchecksumMode=remote I get a lot of [INFO] Unable to find SHA-256 checksum for org.slf4j:slf4j-api:jar:1.7.36:compile on remote. Downloading and calculating locally. so remote is not working for me.