Class ArtifactDigestsGeneratorMojo

  • All Implemented Interfaces:
    org.apache.maven.plugin.ContextEnabled, org.apache.maven.plugin.Mojo

    @Mojo(name="generate-artifact-digests",
          defaultPhase=PACKAGE,
          requiresProject=true)
    public class ArtifactDigestsGeneratorMojo
    extends org.apache.maven.plugin.AbstractMojo
    Generates cryptographic digest files for build artifacts (JARs, WARs, ZIPs).

    This mojo scans the project's build directory for artifacts matching the configured include patterns, computes cryptographic digests using streaming hash computation (never loading full artifact files into heap memory), and writes either sidecar digest files or a central ledger.

    Security rationale: Build artifacts must be hashed at package time so that the verify mojo can detect any tampering before deployment.

    Performance: Uses 64 KiB streaming hash buffers for low heap pressure even on large JAR/WAR files. Handles multi-module projects efficiently.

    Algorithm constraints: Supports SHA-256 (default), SHA-384, SHA-512. MD5 and SHA-1 are available via explicit opt-in but emit build warnings as they are compromised.

    • Method Detail

      • execute

        public void execute()
                     throws org.apache.maven.plugin.MojoExecutionException
        Throws:
        org.apache.maven.plugin.MojoExecutionException