1 /*
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 */
19 package org.eclipse.aether.spi.checksums;
20
21 import java.io.IOException;
22 import java.util.List;
23 import java.util.Map;
24
25 import org.eclipse.aether.RepositorySystemSession;
26 import org.eclipse.aether.artifact.Artifact;
27 import org.eclipse.aether.metadata.Metadata;
28 import org.eclipse.aether.repository.ArtifactRepository;
29 import org.eclipse.aether.spi.connector.checksum.ChecksumAlgorithmFactory;
30
31 /**
32 * Component able to provide (trusted) checksums for artifacts.
33 * <p>
34 * Note: the "trusted" meaning depends solely on implementation and the user using it. Resolver itself does nothing
35 * for "trust" (like some crypto magic or what not). It all boils down that the source being used by implementation is
36 * "trusted" by user or not.
37 *
38 * @since 1.9.0
39 */
40 public interface TrustedChecksumsSource {
41 /**
42 * May return the trusted checksums (for given artifact) from trusted source, or {@code null} if not enabled.
43 * Enabled trusted checksum source SHOULD return non-null (empty map) result, when it has no data for given
44 * artifact. Empty map means in this case "no information", but how that case is interpreted depends on consumer
45 * for trusted checksums.
46 *
47 * @param session The repository system session, never {@code null}.
48 * @param artifact The artifact we want checksums for, never {@code null}.
49 * @param artifactRepository The origin repository: local, workspace, remote repository, never {@code null}.
50 * @param checksumAlgorithmFactories The checksum algorithms that are expected, never {@code null}.
51 * @return Map of expected checksums, or {@code null} if not enabled.
52 */
53 Map<String, String> getTrustedArtifactChecksums(
54 RepositorySystemSession session,
55 Artifact artifact,
56 ArtifactRepository artifactRepository,
57 List<ChecksumAlgorithmFactory> checksumAlgorithmFactories);
58
59 /**
60 * May return the trusted checksums (for given metadata) from trusted source, or {@code null} if not enabled
61 * or the implementation does not cover metadata. Semantics are the same as for
62 * {@link #getTrustedArtifactChecksums(RepositorySystemSession, Artifact, ArtifactRepository, List)}, but
63 * covering metadata: metadata like {@code maven-metadata.xml} influences resolution decisions (for example
64 * version range selection), so trusted sources able to attest metadata should expose that here.
65 * <p>
66 * The default implementation returns {@code null} ("not enabled for metadata"), preserving the behavior of
67 * implementations written before this method existed.
68 *
69 * @param session The repository system session, never {@code null}.
70 * @param metadata The metadata we want checksums for, never {@code null}.
71 * @param artifactRepository The origin repository: local, workspace, remote repository, never {@code null}.
72 * @param checksumAlgorithmFactories The checksum algorithms that are expected, never {@code null}.
73 * @return Map of expected checksums, or {@code null}.
74 * @since 2.0.23
75 */
76 default Map<String, String> getTrustedMetadataChecksums(
77 RepositorySystemSession session,
78 Metadata metadata,
79 ArtifactRepository artifactRepository,
80 List<ChecksumAlgorithmFactory> checksumAlgorithmFactories) {
81 return null;
82 }
83
84 /**
85 * A writer that is able to write/add trusted checksums to this implementation.
86 */
87 interface Writer {
88 /**
89 * Performs whatever implementation requires to "set" (write/add/append) given map of trusted checksums.
90 * The passed in list of checksum algorithm factories and the map must have equal size and mapping must
91 * contain all algorithm names in list.
92 */
93 void addTrustedArtifactChecksums(
94 Artifact artifact,
95 ArtifactRepository artifactRepository,
96 List<ChecksumAlgorithmFactory> checksumAlgorithmFactories,
97 Map<String, String> trustedArtifactChecksums)
98 throws IOException;
99
100 /**
101 * Performs whatever implementation requires to "set" (write/add/append) given map of trusted checksums,
102 * for given metadata. Semantics are the same as for
103 * {@link #addTrustedArtifactChecksums(Artifact, ArtifactRepository, List, Map)}, but covering metadata.
104 * <p>
105 * The default implementation records nothing, preserving the behavior of implementations written before
106 * this method existed.
107 *
108 * @since 2.0.23
109 */
110 default void addTrustedMetadataChecksums(
111 Metadata metadata,
112 ArtifactRepository artifactRepository,
113 List<ChecksumAlgorithmFactory> checksumAlgorithmFactories,
114 Map<String, String> trustedMetadataChecksums)
115 throws IOException {
116 // no-op: implementations written before this method existed record artifact checksums only
117 }
118 }
119
120 /**
121 * Some trusted checksums sources may implement this optional method: ability to write/add checksums to them.
122 * If source does not support this feature, method should return {@code null}.
123 */
124 Writer getTrustedArtifactChecksumsWriter(RepositorySystemSession session);
125 }