Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .idea/compiler.xml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions .idea/encodings.xml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions .idea/misc.xml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions .idea/modules.xml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions ai-rag-service/.gitattributes
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
/mvnw text eol=lf
*.cmd text eol=crlf
33 changes: 33 additions & 0 deletions ai-rag-service/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
HELP.md
target/
.mvn/wrapper/maven-wrapper.jar
!**/src/main/**/target/
!**/src/test/**/target/

### STS ###
.apt_generated
.classpath
.factorypath
.project
.settings
.springBeans
.sts4-cache

### IntelliJ IDEA ###
.idea
*.iws
*.iml
*.ipr

### NetBeans ###
/nbproject/private/
/nbbuild/
/dist/
/nbdist/
/.nb-gradle/
build/
!**/src/main/**/build/
!**/src/test/**/build/

### VS Code ###
.vscode/
3 changes: 3 additions & 0 deletions ai-rag-service/.mvn/wrapper/maven-wrapper.properties
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
wrapperVersion=3.3.4
distributionType=only-script
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
Comment on lines +1 to +3

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE="ai-rag-service/.mvn/wrapper/maven-wrapper.properties"
echo "== $FILE =="
if [ -f "$FILE" ]; then
  nl -ba "$FILE" | sed -n '1,120p'
else
  echo "File not found: $FILE"
  exit 1
fi

Repository: Rd4dev/Mert

Length of output: 175


🌐 Web query:

Apache Maven 3.9.16 apache-maven-3.9.16-bin.zip SHA-256

💡 Result:

The official Apache Maven distribution directory for version 3.9.16 provides SHA-512 checksum files, but does not provide SHA-256 checksum files [1]. To verify the integrity of the apache-maven-3.9.16-bin.zip file, the Apache Maven project officially recommends verifying the PGP signature [2]. You can download the detached signature file (apache-maven-3.9.16-bin.zip.asc) from the official distribution index [1] and verify it against the public keys used by the Apache Maven developers [2]. If you specifically require the SHA-256 checksum for your own local setup (such as for use in a Maven wrapper configuration), you must calculate it yourself after downloading the file [3]. You can generate the SHA-256 checksum of the file on a system with standard tools using the following command: shasum -a 256 apache-maven-3.9.16-bin.zip Alternatively, if you are using Windows PowerShell, you can use: Get-FileHash apache-maven-3.9.16-bin.zip -Algorithm SHA256

Citations:


🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE="ai-rag-service/.mvn/wrapper/maven-wrapper.properties"
echo "== $FILE =="
if [ -f "$FILE" ]; then
  sed -n '1,200p' "$FILE"
else
  echo "File not found: $FILE"
  exit 1
fi

Repository: Rd4dev/Mert

Length of output: 282


🌐 Web query:

maven wrapper 3.3.4 distributionSha256Sum distributionSha512Sum properties

💡 Result:

In Maven Wrapper (including version 3.3.4), checksum verification is supported through specific properties in the.mvn/wrapper/maven-wrapper.properties file to ensure the integrity of downloaded files and prevent supply-chain attacks [1][2]. The supported properties for checksum verification are: 1. distributionSha256Sum: Specifies the expected SHA-256 checksum (in hex notation, small caps) of the Maven distribution being downloaded [1][2]. 2. wrapperSha256Sum: Specifies the expected SHA-256 checksum (in hex notation, small caps) of the maven-wrapper.jar file [3][1][2]. Regarding SHA-512 support: While there have been development discussions and pull requests (such as MWRAPPER-117) to introduce distributionSha512Sum and wrapperSha512Sum properties [4], these were not part of the standard, stable feature set for the 3.3.4 release. As of Maven Wrapper 3.3.4, the official documentation and API only explicitly recognize and implement SHA-256 checksum validation [3][1][5][6]. Key points for configuration: - Properties must be added to.mvn/wrapper/maven-wrapper.properties [1][2]. - When using the maven-wrapper-plugin to update or reinstall the wrapper, existing manual properties like distributionSha256Sum may be overwritten or removed unless handled carefully, as the plugin often regenerates the properties file [7]. - Checksums should be provided in hexadecimal format using lowercase letters [1][2].

Citations:


Pin Maven Wrapper checksums to prevent unchecked downloads
ai-rag-service/.mvn/wrapper/maven-wrapper.properties doesn’t set distributionSha256Sum (and also lacks wrapperSha256Sum), so the wrapper can’t validate downloaded artifacts via checksums beyond TLS.
Apache Maven doesn’t publish SHA-256 for Maven 3.9.16 (it provides SHA-512 and PGP signatures); verify the official apache-maven-3.9.16-bin.zip using those, compute its SHA-256, then pin distributionSha256Sum (and wrapperSha256Sum) to enable checksum validation.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ai-rag-service/.mvn/wrapper/maven-wrapper.properties` around lines 1 - 3, The
maven-wrapper properties file is missing checksum pins, so add
distributionSha256Sum (for the apache-maven-3.9.16-bin.zip referenced by
distributionUrl) and wrapperSha256Sum (for the maven-wrapper binary) to enable
checksum validation: verify the official apache-maven-3.9.16-bin.zip (using
Apache’s PGP/SHA-512 artifacts), compute its SHA-256 and set
distributionSha256Sum=<computed-sha256>, then compute the SHA-256 for the
maven-wrapper jar used by this project and set
wrapperSha256Sum=<computed-sha256>; keep existing keys (wrapperVersion,
distributionType, distributionUrl) unchanged.

295 changes: 295 additions & 0 deletions ai-rag-service/mvnw

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading