Built by Maven

ai-build-integrity:generate-artifact-digests

Full name:

com.intsof:ai-build-integrity-maven-plugin:0.13.2:generate-artifact-digests

Description:

Generates cryptographic digest files for build artifacts (JARs, WARs, ZIPs).

This mojo scans the project's build directory for artifacts matching the configured include patterns, computes cryptographic digests using streaming hash computation (never loading full artifact files into heap memory), and writes either sidecar digest files or a central ledger.

Security rationale: Build artifacts must be hashed at package time so that the verify mojo can detect any tampering before deployment.

Performance: Uses 64 KiB streaming hash buffers for low heap pressure even on large JAR/WAR files. Handles multi-module projects efficiently.

Algorithm constraints: Supports SHA-256 (default), SHA-384, SHA-512. MD5 and SHA-1 are available via explicit opt-in but emit build warnings as they are compromised.

Attributes:

  • Requires a Maven project to be executed.
  • The goal is not marked as thread-safe and thus does not support parallel builds.
  • Binds by default to the lifecycle phase: package.

Optional Parameters

Name Type Since Description
<algorithms> String[] - Array of algorithms to compute. Supports SHA-256, SHA-384, SHA-512, and opt-in MD5, SHA-1.
Default: SHA-256
User Property: ai.integrity.algorithms
<artifactExcludes> String - Comma-separated glob patterns for artifacts to exclude from hashing.
Default: **/*-sources.jar,**/*-javadoc.jar
User Property: ai.integrity.artifactExcludes
<artifactIncludes> String - Comma-separated glob patterns for artifacts to hash (e.g. **\/*.jar,**\/*.war,**\/*.zip).
Default: **/*.jar,**/*.war,**/*.zip
User Property: ai.integrity.artifactIncludes
<centralDigestFile> String - Explicit path to the central digest ledger file. When set, overrides the default and enables child modules in a multi-module project to write to a shared ledger.
User Property: ai.integrity.centralDigestFile
<generateAggregateDigest> boolean - If true, compute a SHA-256 hash of all artifact digests for quick nightly verification. Output file: ai-integrity-artifacts-aggregate.sha256
Default: false
User Property: ai.integrity.generateAggregateDigest
<hashFileMode> HashFileMode - Strategy for storing generated digests (SIDECAR or CENTRAL).
Default: SIDECAR
User Property: ai.integrity.hashFileMode
<includeAttachedArtifacts> boolean - If true, include attached artifacts (sources, javadoc, test jars) in addition to primary artifacts.
Default: false
User Property: ai.integrity.includeAttachedArtifacts
<outputEncoding> String - Encoding for digest files.
Default: UTF-8
User Property: ai.integrity.outputEncoding
<skip> boolean - If true, skips the execution of the mojo. Accepts both -Dai.integrity.skip=true and the Maven-conventional -Dskip.ai.integrity=true.
Default: false
User Property: ai.integrity.skip
<skipAlt> boolean - Alternate Maven-conventional skip flag (e.g. -Dskip.ai.integrity=true).
Default: false
User Property: skip.ai.integrity
<warnOnCompromisedAlgorithm> boolean - If true, emit a build WARNING when MD5 or SHA-1 is used. Recommended to keep enabled.
Default: true
User Property: ai.integrity.warnOnCompromisedAlgorithm

Parameter Details

<algorithms>

Array of algorithms to compute. Supports SHA-256, SHA-384, SHA-512, and opt-in MD5, SHA-1.
  • Type: java.lang.String[]
  • Required: No
  • User Property: ai.integrity.algorithms
  • Default: SHA-256

<artifactExcludes>

Comma-separated glob patterns for artifacts to exclude from hashing.
  • Type: java.lang.String
  • Required: No
  • User Property: ai.integrity.artifactExcludes
  • Default: **/*-sources.jar,**/*-javadoc.jar

<artifactIncludes>

Comma-separated glob patterns for artifacts to hash (e.g. **\/*.jar,**\/*.war,**\/*.zip).
  • Type: java.lang.String
  • Required: No
  • User Property: ai.integrity.artifactIncludes
  • Default: **/*.jar,**/*.war,**/*.zip

<centralDigestFile>

Explicit path to the central digest ledger file. When set, overrides the default and enables child modules in a multi-module project to write to a shared ledger.
  • Type: java.lang.String
  • Required: No
  • User Property: ai.integrity.centralDigestFile

<generateAggregateDigest>

If true, compute a SHA-256 hash of all artifact digests for quick nightly verification. Output file: ai-integrity-artifacts-aggregate.sha256
  • Type: boolean
  • Required: No
  • User Property: ai.integrity.generateAggregateDigest
  • Default: false

<hashFileMode>

Strategy for storing generated digests (SIDECAR or CENTRAL).
  • Type: com.intsof.ai.build.integrity.HashFileMode
  • Required: No
  • User Property: ai.integrity.hashFileMode
  • Default: SIDECAR

<includeAttachedArtifacts>

If true, include attached artifacts (sources, javadoc, test jars) in addition to primary artifacts.
  • Type: boolean
  • Required: No
  • User Property: ai.integrity.includeAttachedArtifacts
  • Default: false

<outputEncoding>

Encoding for digest files.
  • Type: java.lang.String
  • Required: No
  • User Property: ai.integrity.outputEncoding
  • Default: UTF-8

<skip>

If true, skips the execution of the mojo. Accepts both -Dai.integrity.skip=true and the Maven-conventional -Dskip.ai.integrity=true.
  • Type: boolean
  • Required: No
  • User Property: ai.integrity.skip
  • Default: false

<skipAlt>

Alternate Maven-conventional skip flag (e.g. -Dskip.ai.integrity=true).
  • Type: boolean
  • Required: No
  • User Property: skip.ai.integrity
  • Default: false

<warnOnCompromisedAlgorithm>

If true, emit a build WARNING when MD5 or SHA-1 is used. Recommended to keep enabled.
  • Type: boolean
  • Required: No
  • User Property: ai.integrity.warnOnCompromisedAlgorithm
  • Default: true