search

eureka-bpo / p2repository.com

P2repository.com bugtracker
0 stars 0 forks source link

How to increase security #1

Open wimjongman opened 7 months ago

wimjongman commented 7 months ago

Thank you for this service. 🙏

How can we know that what you provide as bundles is safe?

eureka-bpo commented 7 months ago

Each p2-repository has file "artifacts.xml" (possible with jar or xz extension). This file contains a list of bundles and their checksums (usually SHA-512, SHA-256, sometimes MD-5). All these algorithms are supported by maven and can be used to validate jars of bundles. Content of bundles is transmitted by service without modification, checksum remains unchanged.

Service generates maven-specific artifacts: pom.xml, metadata-files - to adapt p2-repository structure for usage with maven.

wimjongman commented 7 months ago

Thanks for getting back so quickly. Please do not take this as being ungrateful. I am just being paranoid,

Is it not possible for you to repackage? How can consumers be sure that the content you are redistribution matches the original content?

eureka-bpo commented 7 months ago

Is it not possible for you to repackage?

Service stores only metadata of p2-artifacts, not their binary content. For binary content service serves as proxy between customer and one of p2-repository mirror.

How can consumers be sure that the content you are redistribution matches the original content?

Maven resolver proposes different strategies to validate checksums. If default validation is not enough, customer can download artifacts.xml, extract checksums for all p2-repository artifacts and use it to validate service output. In this case validation will be absolute independent.

wimjongman commented 3 months ago

Why the title change?

eureka-bpo commented 3 months ago

Maven enforcer custom rule require-p2-artifact-checksum has been prepared, which validates downloaded files with hashes received directly from p2 repository. Suppose, this is highest level of security: it works absolutely without intermediaries.

How it works?

Why the title change?

Title has been changed because of security is not a binary term: is anything safe or not safe. There are 50 grades of security and each user can have possibility select what he/she want. This enforcer rule gives such possibility.

wimjongman commented 3 months ago

Thank you!