Nexus 3 - Validate retrieved content with md5 checksum? - Sonatype Nexus Repository - Sonatype Community
Nexus 3 - Validate retrieved content with md5 checksum?
post by phil on Dec 7, 2020
Phil Wilkins
I’m looking into the adoption of Nexus 3 repository manager. Our security manager has asked what security mechanisms are in place when retrieving content from Maven Central e.g. in addition to the connection being SSL/TLS adoes the Nexus RM compare the md5 checksums?
many thanks
post by rseddon on Dec 7, 2020
Rich Seddon
Checksum validation is done by the client. In the case of central, clients such as Maven optionally will validate the checksum against the original published checksum. You can do that by setting checksumPolicy to either “warn” or “fail”:
If you’d like additional checks to be done you might be interested in our Nexus Firewall product:
That product allows you to define policies against the component’s licenses and known security vulnerabilities, and block components that violate those policies.
Rich
post by msymons on Dec 8, 2020
Mark Symons
The upcoming Maven 4.0.0 release will switch the default checksum policy from “warn” to “fail”. See MNG-5728.
It will also upgrade Maven Resolver to 1.6.1. See MNG-6996, which lists all the new functionality, such as adding support for SHA-256 and SHA-512 as checksums.
I am not sure when v4.0.0 is due for release but I’m hoping it’s soon.