Maven Security

验证：未记录

适用版本: 未记录
验证范围: 尚未登记验证记录。

本文缩写（英文全称与中文含义）

缩写	英文全称／名称	中文含义
BOM	Bill Of Materials	物料清单；Maven 中用于统一依赖版本
CA	Certificate Authority	证书颁发机构
CI	Continuous Integration	持续集成
JDK	Java Development Kit	Java 开发工具包
OWASP	Open Worldwide Application Security Project	开放全球应用安全项目
PR	Pull Request	代码合并请求
TLS	Transport Layer Security	传输层安全协议

Links#

https://maven.apache.org/guides/mini/guide-encryption.html
https://maven.apache.org/guides/mini/guide-deployment-security-settings.html
https://owasp.org/www-project-dependency-check/
https://docs.github.com/en/code-security/dependabot
https://docs.renovatebot.com/

1. Important Points#

supply chain security:
    control repositories
    control versions
    scan dependencies
    protect credentials
    keep release artifacts immutable

2. Vulnerable Dependency Workflow#

修复依赖漏洞要验证实际解析版本及兼容性；exclusion 只用于应移除的依赖，不能把扫描忽略当作修复。

1. identify vulnerable jar and fixed version
2. locate dependency path with dependency:tree
3. upgrade direct dependency or BOM first
4. if blocked, override transitive dependency in dependencyManagement
5. use exclusion only when the jar must be removed
6. run tests and smoke test
7. verify scanner result
8. document reason in PR or release note

./mvnw dependency:tree -Dincludes=org.example:vulnerable-lib
./mvnw versions:display-dependency-updates

3. OWASP Dependency Check#

<plugin>
  <groupId>org.owasp</groupId>
  <artifactId>dependency-check-maven</artifactId>
  <version>10.0.3</version>
  <executions>
    <execution>
      <goals>
        <goal>check</goal>
      </goals>
    </execution>
  </executions>
  <configuration>
    <failBuildOnCVSS>7</failBuildOnCVSS>
  </configuration>
</plugin>

./mvnw dependency-check:check

4. Dependabot / Renovate#

use:
    regular dependency update PR
    grouped patch updates
    separate major version updates
    security PR priority

5. Repository Policy#

policy:
    use company mirror/proxy
    block unknown external repositories
    separate snapshot and release repositories
    require credentials only in settings.xml

6. Secrets#

do not commit:
    settings.xml with passwords
    repository tokens
    signing private keys
    .env files

use:
    CI secrets
    mounted settings.xml
    Docker BuildKit secret

7. Reproducible Build#

rules:
    no RELEASE / LATEST
    no open version ranges
    explicit plugin versions
    Maven Wrapper committed
    build image or JDK version pinned

8. TLS#

rules:
    keep TLS verification enabled
    import company CA into truststore
    pass truststore through MAVEN_OPTS or JAVA_TOOL_OPTIONS
    rotate repository tokens and signing keys