From 43ccdcc68970a961292743a10865951e35fb1b1d Mon Sep 17 00:00:00 2001 From: Mikolaj Izdebski Date: Mon, 7 Jul 2025 07:33:39 +0200 Subject: [PATCH] Pin core ITs to a specific Git commit by full SHA-1 Avoids ambiguity and potential ref hijacking by checking out commits using full 40-character SHA-1 hashes instead of short IDs or ref names. This ensures that the desired commit is checked out even if the repository contains maliciously crafted refs. --- plans/matrix.fmf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/plans/matrix.fmf b/plans/matrix.fmf index 85887f0..1cbe89c 100644 --- a/plans/matrix.fmf +++ b/plans/matrix.fmf @@ -6,7 +6,8 @@ execute: how: tmt environment: - MAVEN_IT_GIT_REF: maven-3.9.x + # branch maven-3.9.x + MAVEN_IT_GIT_REF: e3f9b7c9671cdd67bffe5c2d2663b2d92f05441c /jdk21: environment+: