Maven CI matrix has no Windows leg, a stale 4.0 RC, and no legs at the resolver boundaries #267

[agent] Filed by Claude Code on behalf of Mikola Lysenko (@mikolalysenko) while adding Maven patch SBOM annotations to depscan. Repro artifacts were produced with real Maven and a stub patch API.

Summary

The real-Maven capstones (e2e_redirect_maven_build, e2e_vendor_maven_build) run on:

• ubuntu with 3.6.3, 3.8.9, 3.9.16 and 4.0.0-rc-6
• macOS with 3.9.16

This leaves the following gaps:

1. No Windows leg. The vendored <url>file://${project.basedir}/.socket/vendor/maven/<uuid></url> interpolates to file://C:\…\.socket/vendor/… on Windows. Nothing verifies that Maven resolves that form, with its mixed separators and missing third slash. The install step also exports bin/mvn (the POSIX script) and extracts only the .tar.gz. A Windows leg needs the .zip and bin\mvn.cmd, and mvn_command needs to run it through cmd /c.
2. 4.0.0-rc-6 is stale. 4.0.0-rc-7 is current on dlcdn/archive. Verified locally: rc-7 passes both the hosted and vendored flows, and it enforces Trusted Checksums with the resolver-2 message.
3. No boundary legs:
   • 3.9.3 / 3.9.4: the Trusted Checksums enforcement boundary (see the separate issue).
   • 3.10.0-rc-1: Resolver 2 on the 3.x line, with a different checksum-failure message and .meta/prefixes.txt probing.
   • Nothing below 3.6.3. That may be intentional, but it should be documented as the floor.

Impact

• The Windows vendored path is completely untested, and a silent fail-open there (the file:// URL not resolving, so Maven falls through to Central at the same GAV) would not be caught.
• Resolver-2-specific behavior (prefix-file probes against the Socket repo, message format) is untested on the 3.x line.

Repro / evidence

• .github/workflows/ci.yml:981-993 (matrix) and :1165-1186 (install step: .tar.gz only, exports …/bin/mvn).
• Local darwin/arm64 runs against the CLI built from 3efdc31d:
  • 4.0.0-rc-7 vendored single-module: PATCHED.
  • 4.0.0-rc-7 vendored <subprojects>: PATCHED.
  • 4.0.0-rc-7 hosted re-signed tamper: rejected ("Checksum validation failed … Trusted Checksums Source: summaryFile").
  • 3.10.0-rc-1: rejected with the same message.
• No Windows host was available to reproduce item 1, so it is untested, not known broken.

Expected vs actual

• Expected: a Windows leg (at least 3.9.x hosted and vendored), rc-7, and 3.9.3 / 3.9.4 / 3.10.0-rc-1 legs.
• Actual: none of those exist.

CLI revision

3efdc31d

Suggested fix

Change the matrix to:

• ubuntu: 3.6.3, 3.8.9, 3.9.3, 3.9.4, 3.9.16, 3.10.0-rc-1, 4.0.0-rc-7
• macOS: 3.9.16
• windows: 3.9.16 and 4.0.0-rc-7

Then:

• Use the .zip + mvn.cmd on Windows.
• Gate enforces_trusted_checksums at 3.9.4.