EternalCore is a modern, actively maintained alternative to EssentialsX. It provides the most important server features
GH-1381 Verify dependency integrity (checksums) and add download timeouts (#1381)
- harden: verify dependency integrity and add download timeouts
Fixes two findings from the loader audit:
Runtime-downloaded dependencies were loaded with no integrity check. DependencyDownloader now verifies every artifact against the strongest checksum the repository publishes (sha512 > sha256 > sha1) before it is written to the local cache and added to the classpath. Fails closed: a mismatch or the absence of any published checksum rejects that repository so resolution falls back to another source (and errors if none can vouch for the artifact). Adds a pure, unit-tested Checksum utility.
Jar, checksum, and POM fetches had no connect/read timeouts, so a slow or half-open repository could stall plugin startup. All three now set a 15s connect / 30s read timeout.
Co-Authored-By: Claude Opus 4.8 [email protected] Claude-Session: https://claude.ai/code/session_01JrkLFxzmmn7BpB9y6vMTeg
- Update eternalcore-plugin/src/main/java/com/eternalcode/core/loader/dependency/DependencyDownloader.java
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 [email protected] Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>