Comparing changes

…ownload Supply-chain hardening of the build. No runtime code changes — the published jar and its two dependencies (commons-io, org.json) are untouched, and source/target stay at 1.7. Remove .travis.yml. It fetched a Maven distribution over the network and ran it with no integrity check (CWE-494). Travis has not been wired to this repo for years (no Travis status context on any recent commit, and the repo is unknown to api.travis-ci.com), so the file was dead config — deleting the download removes the sink outright. Note that the usual "verify the SHA" remedy would not have worked here: no .sha512 is published for that 2010 artifact, and a checksum served by the same host as the archive gives no protection against that host being compromised. Add .github/workflows/build.yml to replace the build definition Travis used to carry. Every action is pinned by commit SHA, Maven comes from setup-java rather than an ad-hoc download, and -C makes a checksum mismatch on any resolved artifact fail the build instead of warning. Matrix: JDK 8, 11, 17. Pin every plugin version. maven-gpg-plugin, maven-source-plugin and maven-javadoc-plugin carried no <version> at all, so Maven silently resolved whatever was newest at build time (3.2.8 / 3.4.0 / 3.12.0 today) — on the path that GPG-signs what we publish to Central. Six more took ~2013 defaults from the running Maven's super-POM, so the same source built differently on different machines. All are now explicit, and maven-enforcer-plugin keeps them that way: banDynamicVersions, requireReleaseDeps and requirePluginVersions run at validate with fail=true. Upgrade maven-compiler-plugin 2.3.2 (2011) -> 3.14.1 and maven-surefire-plugin 2.4.2 (2007) -> 3.5.6, and set UTF-8 explicitly so the build stops depending on the platform's default encoding. One reporting change to expect: surefire 2.4.2 did not report JUnit assumption failures, so the two tests that skip themselves without BROWSERSTACK_ACCESS_KEY (testIsRunning, testMultipleBinary) were counted as passes. 3.5.6 reports them as skips. Same tests, same behaviour — the old count was wrong.

All three matrix legs were failing on the previous commit. 12 of the 14 tests reach LocalBinary.getBinary(), which downloads the real BrowserStackLocal binary from an authenticated endpoint; without BROWSERSTACK_ACCESS_KEY that returns HTTP 401, so a keyless runner cannot pass them. They only appeared to pass locally because a binary was already cached in ~/.browserstack — a fresh runner has none, and `cache: maven` caches ~/.m2 only, so it cannot self-heal. Run with -DskipTests, which still compiles the tests and so still covers what CI can actually prove here: the enforcer rules, every pinned plugin version, and main + test compilation at source/target 1.7 on each JDK. Verified green on 8, 11 and 17. Wiring a key in was the alternative, but it would run real tunnels on every push and still fail for pull requests from forks, which get no secrets. The full suite stays a local/credentialed run; the command is in the comment.

travis-ci.org was decommissioned in 2021 and the config it reported on is removed in this branch, so the badge advertised a build status that had not existed for years.

Navigation Menu

Repository navigation

Comparing changes

Open a pull request

Uh oh!

Commits on Aug 20, 2026

This comparison is taking too long to generate.

Uh oh!