From bcff0cfd61dad4b44fbfea60b185bc368c88546b Mon Sep 17 00:00:00 2001 From: Ariel Miculas Trif Date: Wed, 23 Jul 2025 12:50:15 +0300 Subject: [PATCH 1/2] Sha1 hashes are not correctly identified when other hashes exist $ mvn test [INFO] Running org.apache.maven.index.updater.IndexDataTest [ERROR] Tests run: 12, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 1.179 s <<< FAILURE! -- in org.apache.maven.index.updater.IndexDataTest [ERROR] org.apache.maven.index.updater.IndexDataTest.testIdentify -- Time elapsed: 0.077 s <<< FAILURE! java.lang.AssertionError: expected:<1> but was:<0> at org.junit.Assert.fail(Assert.java:89) at org.junit.Assert.failNotEquals(Assert.java:835) at org.junit.Assert.assertEquals(Assert.java:647) at org.junit.Assert.assertEquals(Assert.java:633) at org.apache.maven.index.AbstractRepoNexusIndexerTest.testIdentify(AbstractRepoNexusIndexerTest.java:392) at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104) at java.base/java.lang.reflect.Method.invoke(Method.java:565) at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:59) at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12) at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:56) at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17) at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26) at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27) at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306) at org.junit.runners.BlockJUnit4ClassRunner$1.evaluate(BlockJUnit4ClassRunner.java:100) at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366) at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:103) at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:63) at org.junit.runners.ParentRunner$4.run(ParentRunner.java:331) at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:79) at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:329) at org.junit.runners.ParentRunner.access$100(ParentRunner.java:66) at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:293) at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306) at org.junit.runners.ParentRunner.run(ParentRunner.java:413) at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:316) at org.apache.maven.surefire.junit4.JUnit4Provider.executeWithRerun(JUnit4Provider.java:240) at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:214) at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:155) at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:385) at org.apache.maven.surefire.booter.ForkedBooter.execute(ForkedBooter.java:162) at org.apache.maven.surefire.booter.ForkedBooter.run(ForkedBooter.java:507) at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:495) ... [INFO] Results: [INFO] [ERROR] Failures: [ERROR] DefaultIndexNexusIndexerTest>AbstractRepoNexusIndexerTest.testIdentify:392 expected:<1> but was:<0> [ERROR] FullIndexNexusIndexerTest>AbstractRepoNexusIndexerTest.testIdentify:392 expected:<1> but was:<0> [ERROR] MinimalIndexNexusIndexerTest>AbstractRepoNexusIndexerTest.testIdentify:392 expected:<1> but was:<0> [ERROR] NexusIndexerTest.testIdentity:467 expected:<1> but was:<0> [ERROR] IndexDataTest>AbstractRepoNexusIndexerTest.testIdentify:392 expected:<1> but was:<0> [INFO] [ERROR] Tests run: 225, Failures: 5, Errors: 0, Skipped: 1 --- indexer-core/src/test/repo/qdox/qdox/1.5/qdox-1.5.jar.sha256 | 1 + indexer-core/src/test/repo/qdox/qdox/1.5/qdox-1.5.jar.sha512 | 1 + 2 files changed, 2 insertions(+) create mode 100644 indexer-core/src/test/repo/qdox/qdox/1.5/qdox-1.5.jar.sha256 create mode 100644 indexer-core/src/test/repo/qdox/qdox/1.5/qdox-1.5.jar.sha512 diff --git a/indexer-core/src/test/repo/qdox/qdox/1.5/qdox-1.5.jar.sha256 b/indexer-core/src/test/repo/qdox/qdox/1.5/qdox-1.5.jar.sha256 new file mode 100644 index 00000000..5ec7f255 --- /dev/null +++ b/indexer-core/src/test/repo/qdox/qdox/1.5/qdox-1.5.jar.sha256 @@ -0,0 +1 @@ +f3be9f2ca024528ffdae7fc5311f8b4ba19dbb9c0d46d270e6aa0fb2d537a8ca qdox-1.5.jar diff --git a/indexer-core/src/test/repo/qdox/qdox/1.5/qdox-1.5.jar.sha512 b/indexer-core/src/test/repo/qdox/qdox/1.5/qdox-1.5.jar.sha512 new file mode 100644 index 00000000..cdd915f7 --- /dev/null +++ b/indexer-core/src/test/repo/qdox/qdox/1.5/qdox-1.5.jar.sha512 @@ -0,0 +1 @@ +a78615eb334accf43d0c97e5adb110338978392d134094ca70a372235e177ddf26a9831b3af4635e68da6d2de494d1fab562f6ed431b2115c18f575560468082 qdox-1.5.jar From 514b4eeb0ff4a5e069a1c00b0b146da3b2598554 Mon Sep 17 00:00:00 2001 From: Ariel Miculas Trif Date: Wed, 23 Jul 2025 12:57:43 +0300 Subject: [PATCH 2/2] Include missing sha1 digests in the index When other digest types are present in the scanned directory, such as sha256 and sha512, the sha1 digest is not added to the maven index. This happens because M2GavCalculator.pathToGav handles all the different possible hashes: sha1, sha256, sha512, md5 and strips the extension, resulting in the artifact being classified as having the '.jar' extension. Now, in DefaultArtifactContextProducer.java, the files with extension sha1 or md5 are not indexed so the M2GavCalculator doesn't deal with them. But the other 2 hash types weren't ignored until now and the M2GavCalculator took the sha256/sha512 hash files and deduced there must also be a corresponding jar file. In DefaultScannerListener.artifactDiscovered, the artifacts that were already processed are skipped by this check: if (processedUinfos.contains(uinfo)) { return; // skip individual snapshots } Given the following structure: qdox-1.5.jar qdox-1.5.jar.md5 qdox-1.5.jar.sha1 qdox-1.5.jar.sha256 qdox-1.5.jar.sha512 This means that if we process the file qdox-1.5.jar.sha512 before qdox-1.5.jar, the latter will be skipped entirely. However, the Sha1Locator cannot find the file named qdox-1.5.jar.sha512.sha1 so it misses that the artifact qdox-1.5.jar has the sha1 hash stored in qdox-1.5.jar.sha1, resulting in a missing sha1 hash for this artifact. The easiest solution is to skip processing sha256 and sha512 files entirely, as we do for sha1 and md5 files. Related to #692 --- .../apache/maven/index/DefaultArtifactContextProducer.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/indexer-core/src/main/java/org/apache/maven/index/DefaultArtifactContextProducer.java b/indexer-core/src/main/java/org/apache/maven/index/DefaultArtifactContextProducer.java index 1944758f..b366f889 100644 --- a/indexer-core/src/main/java/org/apache/maven/index/DefaultArtifactContextProducer.java +++ b/indexer-core/src/main/java/org/apache/maven/index/DefaultArtifactContextProducer.java @@ -138,7 +138,9 @@ protected boolean isIndexable(File file) { // || filename.endsWith( ".xml" ) // NEXUS-3029 && !filename.endsWith(".asc") && !filename.endsWith(".md5") - && !filename.endsWith(".sha1"); + && !filename.endsWith(".sha1") + && !filename.endsWith(".sha256") + && !filename.endsWith(".sha512"); } protected Gav getGavFromPath(IndexingContext context, String repositoryPath, String artifactPath) {