[JIRA] (JMVN-22) SNAPSHOT version checking is too strict for M2 checking

[Rod Widdowson (Jira)]

Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 ) *created* an issue

Maven Enforcer ( https://shibboleth.atlassian.net/browse/JMVN?atlOrigin=eyJpIjoiYWExZDhhYTNlNGI4NGY1OTgyNjRkOWEyYWJmMjdlNmEiLCJwIjoiaiJ9 ) / Task ( https://shibboleth.atlassian.net/browse/JMVN-22?atlOrigin=eyJpIjoiYWExZDhhYTNlNGI4NGY1OTgyNjRkOWEyYWJmMjdlNmEiLCJwIjoiaiJ9 ) JMVN-22 ( https://shibboleth.atlassian.net/browse/JMVN-22?atlOrigin=eyJpIjoiYWExZDhhYTNlNGI4NGY1OTgyNjRkOWEyYWJmMjdlNmEiLCJwIjoiaiJ9 ) SNAPSHOT version checking is too strict for M2 checking ( https://shibboleth.atlassian.net/browse/JMVN-22?atlOrigin=eyJpIjoiYWExZDhhYTNlNGI4NGY1OTgyNjRkOWEyYWJmMjdlNmEiLCJwIjoiaiJ9 )

Issue Type: Task Affects Versions: 3,1.0 Assignee: Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 ) Created: 17/Jan/22 10:48 AM Fix Versions: 3.1.1 Priority: Trivial Reporter: Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 )

I ran an M2 check on a pseudo release of idp 4.1.5 and it all went terribly wrong.

The biggest cause of failure was the rule that "though shalt not check for signatures on SNAPSHOT versions of artifacts but only if this is a SNAPSHOT version being build.

This is absolutely correct for checking signatures over distributions, but absolutely wrong for checking snapshots over m2 (where SNAPSHOTS are a way of life).

It might not matter for a real release (when the repository is much more constrained) but we need to be more relaxed about this.

I'll note that this does open a vector if we are rash enough to do a build with a SNAPSHOT versioned plugin (or something that depends on one).

( https://shibboleth.atlassian.net/browse/JMVN-22#add-comment?atlOrigin=eyJpIjoiYWExZDhhYTNlNGI4NGY1OTgyNjRkOWEyYWJmMjdlNmEiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JMVN-22#add-comment?atlOrigin=eyJpIjoiYWExZDhhYTNlNGI4NGY1OTgyNjRkOWEyYWJmMjdlNmEiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100188- sha1:935ca08 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220117/3d33d2f7/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-e437e2cd-5930-4a35-b3f5-d967e6cc4191
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220117/3d33d2f7/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-7358d006-58d0-4bc8-886d-8216734eecac
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220117/3d33d2f7/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-a83e1c90-35cf-473b-979a-13e0c8d5915b
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220117/3d33d2f7/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-22ce4b29-5e0d-4f05-a5e6-3ac0d87875bc
Type: image/png
Size: 468 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220117/3d33d2f7/attachment-0007.png>