Class ArtifactDigestsVerifyMojo

  • All Implemented Interfaces:
    org.apache.maven.plugin.ContextEnabled, org.apache.maven.plugin.Mojo

    @Mojo(name="verify-artifact-digests",
          defaultPhase=VERIFY,
          requiresProject=true)
    public class ArtifactDigestsVerifyMojo
    extends org.apache.maven.plugin.AbstractMojo
    Verifies that build artifacts have not been modified since their digests were generated.

    This mojo reads either sidecar digest files or a central ledger, recomputes the digest of each artifact, and compares against the stored value. If any mismatch is detected and failOnError is true, the build fails.

    Security rationale: Artifact integrity must be verified before deployment to detect any tampering that occurred after packaging.

    Performance: Uses streaming hash computation with 64 KiB buffers. For large artifact sets, verification adds measurable but acceptable time to the build.

    • Method Detail

      • execute

        public void execute()
                     throws org.apache.maven.plugin.MojoExecutionException
        Throws:
        org.apache.maven.plugin.MojoExecutionException