don't trust scmInfo (Forked repositories)

[MasseGuillaume]

Anyone could publishing with a scm that they dont own. (ex: publish ScalaKata with akka/akka).

Maven central enforce the ownership of groupId, but I assume they dont enforce the ownership of scm.

This could be solved by creating a mapping between groupId and scm for maven central and user to scm for Bintray

{
   "com.typesage.akka": ["akka/akka"],
   "com.scalakata": ["masseguillaume/scalakata"]
}

[Scyks]

Hey @heathermiller ,

we need to take a decision on security for publishing via the SBT-Plugin. Like @MasseGuillaume mentioned, there is a security issue that everyone can publish for a groupId he doesn't own.
GitHub's repo push permission is not enough to verify the ownership

Example:
I could fork akka/akka-actor change the scm tag to a repo i have push access and publish a new version in scaladex for akka groupId.

To ensure that you can't do that Guillaume and I discussed some solutions:

1. we add a manual mapping with PR's like suggested above
2. verify the published POM SHA1 against the POM on maven central (then the pom have to be published and we all know that there is a delay)
3. add a stack to scaladex and a task which will be executed every 10 minutes, to try to reach the POM file on maven. On success we can apply the change in the index. After 10 failed downloads we could delete this entry. (User will get no feedback which is maybe a problem)

Also, to keep the "private scaladex" in mind (#15) we should add a configuration for verifying the POM on maven.

What do you think about that? Do you maybe have another solution we can consider?
Would be nice to have a decision to proceed and finish the PR #176 .

Best
Ronald

[MasseGuillaume]

https://index.scala-lang.org/playframework/playframework

is now only displaying a fork

"com.github.thangiee" %% "play-json" % "2.4.2"
resolvers += Resolver.bintrayRepo("thangiee", "maven")

ibid for
https://index.scala-lang.org/playframework/anorm

"com.typesafe.play" %% "anorm-iteratee" % "3.0.0"
resolvers += Resolver.bintrayRepo("buildo", "maven")

[MasseGuillaume]

scalatest is now org.pageobject.patch.org.scalatest at version 3.0.3. Where the current version is 3.0.1

[MasseGuillaume]

I'm bumping this to the next item to work on due to it's severity. I'm currently on working on Scastie embedding. I can start working on this issue in ~ 2weeks.