Improve our checksum support for Maven metadata

[carlspring]

Task Description

We should improve our support for checksums for maven-metadata.xml files. This seems to be a problem for Gradle artifacts and there is now support for sha256 and sha512 in Gradle. Maven Central (running on Nexus 2.x) now supports this.

• Add sha-256 and sha-512 checksums when publishing gradle/gradle#11053 : Add sha-256 and sha-512 checksums when publishing
• maven-metadata.xml SHA256 and SHA512 checksums prevent publishing to Nexus gradle/gradle#11308 : maven-metadata.xml SHA256 and SHA512 checksums prevent publishing to Nexus
• https://issues.sonatype.org/browse/MVNCENTRAL-5276 : Validation should support SHA256 and SHA512 checksums

Tasks

The following tasks will need to be carried out:

• It should be possible to configure what checksums are enabled for a Maven repository.
• It should be possible to configure what checksums are enabled for all Maven repositories.
• It should be possible to configure the checksum options via the UI.
• Review what changes will be required to AbstractLayoutProvider.getDigestAlgorithmSet() or the Maven2LayoutProvider and apply the necessary fixes.
• Re-work the org.carlspring.strongbox.services.impl.ArtifactMetadataServiceImpl and org.carlspring.strongbox.cron.jobs.RebuildMavenMetadataCronJob.
• Add UI for these settings.

Task Relationships

This task:

• Relates to: Implement strict checksum validation for proxy repositories resolving from remotes #1398 , Implement strict checksum validation option for Repository #1512

Help

• Our chat
• Points of contact:
  • @carlspring
  • @sbespalov
  • @steve-todorov

[sainalshah]

@carlspring I can work on this task.

[carlspring]

Hi @sainalshah ,

Feel free to do so, if you think that the current task is clear enough.

[sainalshah]

@carlspring Can I clarify whether the UI changes in strongbox-web-ui are part of this task, or I just need to ensure that the checksum request could be updated from UI?

My understanding is, I could define the supported list of checksums in Maven2LayoutProvider class and per repository configuration could be retrieved from RepositoryData. Whenever the metadata is built/ rebuilt, the checksum would be updated as well. I still have to see how everything connects together though. Please let me know if I'm missing something.

[steve-todorov]

@sainalshah the frontend part is located in the strongbox-web-ui project and the backend part is at strongbox/strongbox. What @carlspring meant was that when you go in the UI at the Storages module and attempt to add/update a Repository - there should be a checkbox or a dropdown for this.

I'm unsure if you should be able to select one or both checksum options @carlspring ?

[carlspring]

I think there should be checkboxes for these. By default, all four (md5, sha1, sha256 and sha512) should be enabled.

[carlspring]

@sainalshah ,

How're things going?

[sainalshah]

I implemented some of the logic, but faced some difficulty when it came to implementing the test cases. Since it's my first time touching this part of the codebase, it's taking bit long for me. Plus I was bit busy these days.

[carlspring]

Sure, no problem! Let us know, if you have any problems, or questions. Good luck! :)