Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of jukka.zitting@gmail.com
 designates 209.85.217.19 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references;
        b=QC2pkxfDUB4gV/YvAnSYQiMbQHRP5EpTX2SMhlqPajH+0bup81UmnubUBc5/7nsdGN
         IjNPPsb6HtWe9yHlGZkN/56QiFWuGLUWmbIpmK+XLET6tWydMZRNkrHEa6snAVxcO/rb
         iFndjzDt19pusxL/3h0Vewy8s/3j9e4d1fruw=
Message-ID: <510143ac0809181201h3f25d113w3f6dcacf8f798485@mail.gmail.com>
Date: Thu, 18 Sep 2008 21:01:15 +0200
From: "Jukka Zitting" <jukka.zitting@gmail.com>
To: general@incubator.apache.org
Subject: Re: Incubator Maven repo [WAS Re: [VOTE] [POLICY] Allow extra release
 distribution channels like the central Maven repository]
In-Reply-To: <48D29D55.6060700@rowe-clan.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <fbdc6a970809161549r11bbcf8ewf3808ac3ee224112@mail.gmail.com>
	 <200809170657.47757.dkulp@apache.org>
	 <1221696340.25066.4.camel@forge.local>
	 <48D1AB65.2050603@rowe-clan.net>
	 <19e0530f0809171825k36681f7dqde8160e343c3d20@mail.gmail.com>
	 <48D1B1E8.3010700@rowe-clan.net>
	 <af2843cd0809180639u2f1b00acu1c42ef668c46c76f@mail.gmail.com>
	 <25aac9fc0809180759y797f8addx8812ea873ac7abcd@mail.gmail.com>
	 <af2843cd0809181100i5eef7c33k27f565a0ce4431a6@mail.gmail.com>
	 <48D29D55.6060700@rowe-clan.net>

Hi,

On Thu, Sep 18, 2008 at 8:26 PM, William A. Rowe, Jr.
<wrowe@rowe-clan.net> wrote:
> Not if there is a man in the middle attack.  If you didn't notice the
> recent noise w.r.t. DNS pollution, that's the very point of that vector.
> Had it been exploited, tens of thousands of download users could have
> been presented with inauthentic maven artifacts, complete with their
> freshly corresponding checksums.  Welcome to the internet.

Using Hiram's plugin the checksums are already stored in the project
that you're building and which you typically got either by checking it
out of svn or by downloading a source release, both of which are
separate from the Maven repository.

Once you've confident that the sources you have are not compromised,
the included checksums will verify that the dependencies that were
downloaded by Maven are also valid (i.e. the same binaries that the
original developer used).

The checksums are _not_ downloaded from the Maven repository.

BR,

Jukka Zitting

---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org