Skip to content

Commit b9c44c1

Browse files
07souravkunda07souravkunda
committed
build: make the build reproducible and retire the unverified Travis download
Supply-chain hardening of the build. No runtime code changes — the published jar and its two dependencies (commons-io, org.json) are untouched, and source/target stay at 1.7. Remove .travis.yml. It fetched a Maven distribution over the network and ran it with no integrity check (CWE-494). Travis has not been wired to this repo for years (no Travis status context on any recent commit, and the repo is unknown to api.travis-ci.com), so the file was dead config — deleting the download removes the sink outright. Note that the usual "verify the SHA" remedy would not have worked here: no .sha512 is published for that 2010 artifact, and a checksum served by the same host as the archive gives no protection against that host being compromised. Add .github/workflows/build.yml to replace the build definition Travis used to carry. Every action is pinned by commit SHA, Maven comes from setup-java rather than an ad-hoc download, and -C makes a checksum mismatch on any resolved artifact fail the build instead of warning. Matrix: JDK 8, 11, 17. Pin every plugin version. maven-gpg-plugin, maven-source-plugin and maven-javadoc-plugin carried no <version> at all, so Maven silently resolved whatever was newest at build time (3.2.8 / 3.4.0 / 3.12.0 today) — on the path that GPG-signs what we publish to Central. Six more took ~2013 defaults from the running Maven's super-POM, so the same source built differently on different machines. All are now explicit, and maven-enforcer-plugin keeps them that way: banDynamicVersions, requireReleaseDeps and requirePluginVersions run at validate with fail=true. Upgrade maven-compiler-plugin 2.3.2 (2011) -> 3.14.1 and maven-surefire-plugin 2.4.2 (2007) -> 3.5.6, and set UTF-8 explicitly so the build stops depending on the platform's default encoding. One reporting change to expect: surefire 2.4.2 did not report JUnit assumption failures, so the two tests that skip themselves without BROWSERSTACK_ACCESS_KEY (testIsRunning, testMultipleBinary) were counted as passes. 3.5.6 reports them as skips. Same tests, same behaviour — the old count was wrong.
1 parent 982ed22 commit b9c44c1

3 files changed

Lines changed: 132 additions & 25 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Build + unit tests. Replaces the abandoned Travis config, which fetched a Maven
2+
# distribution over the network with no integrity check (CWE-494).
3+
#
4+
# Rules for this file:
5+
# * every third-party action is pinned by full commit SHA, never a mutable tag;
6+
# * Maven comes from the runner image / setup-java, never an ad-hoc download;
7+
# * `-C` makes Maven FAIL (not warn) on a checksum mismatch for any artifact.
8+
name: Build
9+
10+
on:
11+
pull_request:
12+
branches: ["master", "main"]
13+
push:
14+
branches: ["master", "main"]
15+
16+
permissions:
17+
contents: read
18+
19+
jobs:
20+
build:
21+
runs-on: ubuntu-latest
22+
strategy:
23+
fail-fast: false
24+
matrix:
25+
java: ['8', '11', '17']
26+
name: build (JDK ${{ matrix.java }})
27+
steps:
28+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
29+
30+
- uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
31+
with:
32+
distribution: temurin
33+
java-version: ${{ matrix.java }}
34+
cache: maven
35+
36+
# -C = strict checksum policy: a checksum mismatch on any resolved artifact
37+
# fails the build instead of printing a warning.
38+
- name: Build and test
39+
run: mvn -B -C -Dgpg.skip clean verify

‎.travis.yml‎

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎pom.xml‎

Lines changed: 93 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,13 @@
1616
</license>
1717
</licenses>
1818

19+
<properties>
20+
<!-- Without this the build uses the platform default encoding, so the same
21+
source produces different bytes on different machines. -->
22+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
23+
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
24+
</properties>
25+
1926
<developers>
2027
<developer>
2128
<name>BrowserStack</name>
@@ -72,6 +79,7 @@
7279
<plugin>
7380
<groupId>org.apache.maven.plugins</groupId>
7481
<artifactId>maven-gpg-plugin</artifactId>
82+
<version>3.2.8</version>
7583
<executions>
7684
<execution>
7785
<id>sign-artifacts</id>
@@ -96,6 +104,7 @@
96104
<plugin>
97105
<groupId>org.apache.maven.plugins</groupId>
98106
<artifactId>maven-source-plugin</artifactId>
107+
<version>3.4.0</version>
99108
<executions>
100109
<execution>
101110
<id>attach-sources</id>
@@ -108,6 +117,7 @@
108117
<plugin>
109118
<groupId>org.apache.maven.plugins</groupId>
110119
<artifactId>maven-javadoc-plugin</artifactId>
120+
<version>3.12.0</version>
111121
<executions>
112122
<execution>
113123
<id>attach-javadocs</id>
@@ -126,6 +136,46 @@
126136
</profiles>
127137

128138
<build>
139+
<!-- Maven binds these six to the lifecycle itself. Left unpinned they take
140+
whatever the running Maven distribution's super-POM happens to default to
141+
(Maven 3.8.6 gives jar 2.4 / resources 2.6 / install 2.4 / deploy 2.7 /
142+
clean 2.5 / site 3.3, all circa 2013) — so the same source builds with a
143+
different plugin set on a different machine. Pinning them makes the build
144+
reproducible and retires the 2013 versions. -->
145+
<pluginManagement>
146+
<plugins>
147+
<plugin>
148+
<groupId>org.apache.maven.plugins</groupId>
149+
<artifactId>maven-clean-plugin</artifactId>
150+
<version>3.5.0</version>
151+
</plugin>
152+
<plugin>
153+
<groupId>org.apache.maven.plugins</groupId>
154+
<artifactId>maven-resources-plugin</artifactId>
155+
<version>3.5.0</version>
156+
</plugin>
157+
<plugin>
158+
<groupId>org.apache.maven.plugins</groupId>
159+
<artifactId>maven-jar-plugin</artifactId>
160+
<version>3.5.1</version>
161+
</plugin>
162+
<plugin>
163+
<groupId>org.apache.maven.plugins</groupId>
164+
<artifactId>maven-install-plugin</artifactId>
165+
<version>3.1.4</version>
166+
</plugin>
167+
<plugin>
168+
<groupId>org.apache.maven.plugins</groupId>
169+
<artifactId>maven-deploy-plugin</artifactId>
170+
<version>3.1.4</version>
171+
</plugin>
172+
<plugin>
173+
<groupId>org.apache.maven.plugins</groupId>
174+
<artifactId>maven-site-plugin</artifactId>
175+
<version>3.22.0</version>
176+
</plugin>
177+
</plugins>
178+
</pluginManagement>
129179
<plugins>
130180
<plugin>
131181
<groupId>org.sonatype.central</groupId>
@@ -138,10 +188,51 @@
138188
<autoPublish>false</autoPublish>
139189
</configuration>
140190
</plugin>
191+
<plugin>
192+
<groupId>org.apache.maven.plugins</groupId>
193+
<artifactId>maven-enforcer-plugin</artifactId>
194+
<version>3.6.3</version>
195+
<executions>
196+
<execution>
197+
<id>enforce-deterministic-dependencies</id>
198+
<phase>validate</phase>
199+
<goals>
200+
<goal>enforce</goal>
201+
</goals>
202+
<configuration>
203+
<rules>
204+
<!-- No version ranges / LATEST / RELEASE: every
205+
coordinate resolves to the same artifact on
206+
every build, on every machine. -->
207+
<banDynamicVersions>
208+
<allowSnapshots>false</allowSnapshots>
209+
<allowLatest>false</allowLatest>
210+
<allowRelease>false</allowRelease>
211+
<allowRanges>false</allowRanges>
212+
</banDynamicVersions>
213+
<requireReleaseDeps>
214+
<message>No SNAPSHOT dependencies allowed.</message>
215+
</requireReleaseDeps>
216+
<!-- Every plugin must carry an explicit version, so a new
217+
upstream release cannot silently enter the build (this
218+
is what used to happen on the gpg/source/javadoc
219+
signing path). -->
220+
<requirePluginVersions>
221+
<banLatest>true</banLatest>
222+
<banRelease>true</banRelease>
223+
<banSnapshots>true</banSnapshots>
224+
<phases>clean,deploy,site</phases>
225+
</requirePluginVersions>
226+
</rules>
227+
<fail>true</fail>
228+
</configuration>
229+
</execution>
230+
</executions>
231+
</plugin>
141232
<plugin>
142233
<groupId>org.apache.maven.plugins</groupId>
143234
<artifactId>maven-compiler-plugin</artifactId>
144-
<version>2.3.2</version>
235+
<version>3.14.1</version>
145236
<configuration>
146237
<source>1.7</source>
147238
<target>1.7</target>
@@ -150,7 +241,7 @@
150241
<plugin>
151242
<groupId>org.apache.maven.plugins</groupId>
152243
<artifactId>maven-surefire-plugin</artifactId>
153-
<version>2.4.2</version>
244+
<version>3.5.6</version>
154245
</plugin>
155246
</plugins>
156247
</build>

0 commit comments

Comments
 (0)