Wire up --incompatible_disallow_unverified_http_downloads for maven_server #9235
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…erver Change-Id: Ibba0269e169f65fddb8b3cea0fc0a3e3905d179c
aiuto
approved these changes
Aug 23, 2019
|
Will there be another warning just simply acknowledging that sha1 is considered cryptographically broken? |
|
@JLLeitschuh The issue with that now is warning spam (especially for projects with many maven_jar rules) with no simple and immediate actionable, like switching to SHA-256 immediately because that attribute does not exist yet. I can look into adding a SHA-256 attribute to maven_jar. |
|
Thank u |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Force usage of either HTTPS or HTTP w/ SHA-1. Note that SHA-1 is still susceptible to collision attacks, but this should reduce the exploitable surface of the current implementation that allows plain HTTP without checksums.
Also see #6799 (comment)