Check if Library Id (GAV) is well known #383
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
henrikplate
reviewed
Jun 16, 2020
| _lib.setDigestVerificationUrl(managed_lib.getDigestVerificationUrl()); | ||
| _lib.setDigestTimestamp(managed_lib.getDigestTimestamp()); | ||
| } | ||
| // // Re-create wellknownDigest if it is null in our current db (this part should be removed once it is created for all) |
There was a problem hiding this comment.
Just delete all those commented sections :)
There was a problem hiding this comment.
you are right, done!
This pull request was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When libraries are saved, the backend checks whether the digest is wellKnown using one of the implemented verifiers, i.e. Maven Central and Pypi.
Problem Observed:
Until now we didn't check whether the libraryId provided by the client is also well known, as a result we may end up with not-well-known library ids saved to the database (even for well known digests).
Solution:
The verifyDigest method now checks that the provided libraryId is wellKnown, and replaces it with the well known one if it isn't (it takes the first in case multiple ones are returned). Note that: