[Security] Maven Repositories: Add Trusted Checksum Verification

[chrisrueger]

Closes #7236

This pull request introduces optional support for trusted checksum verification in the Maven repository providers (MavenBndRepository and BndPomRepository). The main goal is to ensure that downloaded artifacts can validated against a trusted checksum file, improving the integrity and security of repository operations. The changes include new configuration options, core logic for managing and verifying trusted checksums, and integration into repository workflows and UI actions.

Trusted Checksum Support and Verification:

• Added a new TrustedChecksums class to manage trusted checksum files, load and cache checksums, verify artifact integrity, and generate trusted checksum files. This includes logic for reading, writing, and validating checksums for Maven artifacts.
• Implemented a DigestValidator helper class to centralize digest comparison logic, replacing duplicate code and improving maintainability.
• Integrated trusted checksum verification into MavenRepository and MavenBackingRepository, so that artifact retrieval and local file access now check against trusted checksums when available. [1] [2] [3] [4] [5] [6]

Configuration and Initialization:

• Extended the Configuration interface to allow specifying a trusted checksum file path, and updated repository initialization to load and use the trusted checksum file. [1] [2] [3] [4]
• Added logic to generate a trusted checksum file from the current repository state, and exposed this as a repository action in the UI. [1] [2] [3] [4]

Reporting and Versioning:

• Enhanced repository tooltips and reporting to display the status and location of the trusted checksums file when present.
• Updated package versioning to reflect the new feature. [1] [2]

Screenshots

When a Checksum does not match it looks like this:

The file basically does not exist anymore (the failing check deletes it), so the jar cannot be used / resolved etc.

[chrisrueger]

TODOS:

• add configuration to bndtools UI (_plugins.xml <plugin class="aQute.bnd.repository.maven.provider.MavenBndRepository")
• add same support for BndPomRepository

[Copilot]

Pull request overview

This PR adds “trusted checksum” verification for Maven-backed repositories in bnd/bndtools, allowing locally-defined expected digests (via a .checksums sidecar file) to be enforced when artifacts are used. It integrates checksum enforcement into repository workflows, adds UI actions to generate checksum files, updates docs/configuration, and bumps package versions to reflect the new API surface.

Changes:

• Introduces TrustedChecksums + DigestValidator and wires trusted checksum enforcement into MavenRepository access paths.
• Adds checksumFile configuration to Maven index and POM repository providers and surfaces the feature via UI actions/tooltips.
• Adds documentation plus test resources/tests for checksum parsing and pass/fail scenarios.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
docs/_plugins/maven.md	Documents checksumFile and trusted checksum verification behavior.
bndtools.core/_plugin.xml	Adds checksumFile properties to the Eclipse plugin configuration metadata.
biz.aQute.repository/testresources/mavenrepo/index.maven.failing.checksums	Adds failing checksum inputs for tests.
biz.aQute.repository/testresources/mavenrepo/index.maven.checksums	Adds passing checksum inputs for tests.
biz.aQute.repository/test/aQute/maven/provider/TrustedChecksumsTest.java	Adds unit tests for checksum line parsing.
biz.aQute.repository/test/aQute/bnd/repository/maven/provider/MavenBndRepoTest.java	Adds integration tests for trusted checksum pass/fail behavior.
biz.aQute.repository/src/aQute/maven/provider/TrustedChecksums.java	Implements trusted checksum file parsing, caching, validation, and generation.
biz.aQute.repository/src/aQute/maven/provider/packageinfo	Bumps package version for the Maven provider package.
biz.aQute.repository/src/aQute/maven/provider/MavenRepository.java	Enforces trusted checksum checks when returning/using local files and after fetch.
biz.aQute.repository/src/aQute/maven/provider/MavenBackingRepository.java	Refactors digest validation to the shared helper.
biz.aQute.repository/src/aQute/maven/provider/DigestValidator.java	New shared digest-comparison helper for checksum validation.
biz.aQute.repository/src/aQute/bnd/repository/maven/provider/RepoActions.java	Adds a UI action to create trusted checksums files.
biz.aQute.repository/src/aQute/bnd/repository/maven/provider/package-info.java	Bumps package version for MavenBndRepository provider package.
biz.aQute.repository/src/aQute/bnd/repository/maven/provider/MbrUpdater.java	Exposes “create trusted checksums file” through updater API.
biz.aQute.repository/src/aQute/bnd/repository/maven/provider/MavenBndRepository.java	Loads trusted checksum sidecar, wires it into storage, tooltip reporting, and adds generation hook.
biz.aQute.repository/src/aQute/bnd/repository/maven/provider/Configuration.java	Adds checksumFile() configuration property.
biz.aQute.repository/src/aQute/bnd/repository/maven/pom/provider/PomConfiguration.java	Adds checksumFile() configuration property for POM repositories.
biz.aQute.repository/src/aQute/bnd/repository/maven/pom/provider/package-info.java	Bumps package version for POM repository provider package.
biz.aQute.repository/src/aQute/bnd/repository/maven/pom/provider/BndPomRepository.java	Loads trusted checksums, wires into storage, tooltip, and adds “generate” action.