Add sha256 and sha256_src attributes to maven_jar #9237
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Change-Id: I7e9003f373f99bedbf44e9fac4999c25b78c437a
jin
added
the
team-ExternalDeps
Change-Id: I17ef2f88911efbb4527303b1dc1bcb827cc5e308
aiuto
approved these changes
Aug 26, 2019
There was a problem hiding this comment.
I'm happy to see this. When I saw your change for not https+sha1j a few days ago I found it incredible that we only has sha1 hashes for maven. I was going to ask you about it.
This looks great. Just nits about wording. I believe we do people a favor by not "suggesting" they swtich, but telling them they must switch.
| <!-- #END_BLAZE_RULE.ATTRIBUTE --> */ | ||
| .add(attr("sha1", Type.STRING)) | ||
| /* <!-- #BLAZE_RULE(maven_jar).ATTRIBUTE(sha1_src) --> | ||
| A SHA-1 hash of the desired jar source file. | ||
| A SHA-1 hash of the desired jar source file. Please consider using 'sha256_src' instead. |
There was a problem hiding this comment.
I don''t know if we need the "please" in all of these. This is a strong recommendation and my hunch is we will fully remove sha1 in 2.0. I think you are fine with
"A SHA-1 hash of the desired jar source file. (Deprecated: use sha256)"
philwo
added
the
team-OSS
philwo
removed
the
team-OSS
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
..and print warnings if sha256 or sha256_src aren't used, like this:
The warning message is designed to be copy paste-able directly into the WORKSPACE file.
#6799
#8880
RELNOTES: Added
sha256andsha256_srcattributes tomaven_jar. Please consider migrating to SHA-256 as SHA-1 has been deemed cryptographically insecure (https://shattered.io). Or, userules_jvm_externalto manage your transitive Maven dependencies with artifact pinning and SHA-256 verification support.