Skip to content

chore(be): SpringBoot 세팅 (#3) #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
crolvlee merged 3 commits into from
Jun 15, 2026
Merged

chore(be): SpringBoot 세팅 (#3) #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0a31d37
chore(be): 기존 백엔드 코드 제거 (#3)
crolvlee Jun 14, 2026
73f2489
chore(be): SpringBoot 초기 세팅 (#3)
crolvlee Jun 15, 2026
14b10f7
docs(be): ARCHITECTURE.md 수정
crolvlee Jun 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 0 additions & 57 deletions backend/.classpath
View file
Open in desktop

This file was deleted.

2 changes: 2 additions & 0 deletions backend/.gitattributes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
/mvnw text eol=lf
*.cmd text eol=crlf
33 changes: 33 additions & 0 deletions backend/.gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
HELP.md
target/
.mvn/wrapper/maven-wrapper.jar
!**/src/main/**/target/
!**/src/test/**/target/

### STS ###
.apt_generated
.classpath
.factorypath
.project
.settings
.springBeans
.sts4-cache

### IntelliJ IDEA ###
.idea
*.iws
*.iml
*.ipr

### NetBeans ###
/nbproject/private/
/nbbuild/
/dist/
/nbdist/
/.nb-gradle/
build/
!**/src/main/**/build/
!**/src/test/**/build/

### VS Code ###
.vscode/
3 changes: 3 additions & 0 deletions backend/.mvn/wrapper/maven-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
wrapperVersion=3.3.4
distributionType=only-script
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
Comment on lines +1 to +3

@coderabbitai coderabbitai Bot Jun 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

dist_url="$(awk -F= '/^distributionUrl=/{print $2}' backend/.mvn/wrapper/maven-wrapper.properties)"
tmp_dir="$(mktemp -d)"
trap 'rm -rf "$tmp_dir"' EXIT

curl -fsSL "$dist_url" -o "$tmp_dir/maven-dist.zip"
local_sha="$(sha256sum "$tmp_dir/maven-dist.zip" | awk '{print $1}')"
echo "local_sha256=$local_sha"

if curl -fsSL "${dist_url}.sha256" -o "$tmp_dir/remote.sha256"; then
  remote_sha="$(awk '{print $1}' "$tmp_dir/remote.sha256" | tr -d '\r\n')"
  echo "remote_sha256=$remote_sha"
  [ "$local_sha" = "$remote_sha" ] && echo "checksum_match=true" || echo "checksum_match=false"
else
  echo "No remote .sha256 file found at ${dist_url}.sha256; fetch checksum from official Maven release metadata before pinning."
fi

Repository: ssafy-salman/salmanhae

Length of output: 116

🏁 Script executed:

if [ -f backend/.mvn/wrapper/maven-wrapper.properties ]; then
  cat -n backend/.mvn/wrapper/maven-wrapper.properties
else
  echo "File not found"
fi

Repository: ssafy-salman/salmanhae

Length of output: 255

🌐 Web query:

Maven 3.9.16 official release sha256 checksum central repository

💡 Result:

Apache Maven 3.9.16 does not provide sha256 checksums in its official distribution directory [1][2]. Instead, the Apache Maven project provides sha512 checksums for its release artifacts [1][3]. You can find the official sha512 checksum files at the following location: https://downloads.apache.org/maven/maven-3/3.9.16/binaries/ The available files for verification in that directory are: - apache-maven-3.9.16-bin.tar.gz.sha512 [1] - apache-maven-3.9.16-bin.zip.sha512 [1] The Apache Maven team also strongly recommends verifying the PGP signatures (.asc files) of the release bundles against their public KEYS for security [4].

Citations:

🌐 Web query:

Maven wrapper distributionSha256Sum distributionSha512Sum supported properties

💡 Result:

The Maven Wrapper supports checksum verification to prevent supply-chain attacks by ensuring that downloaded binaries are not corrupted [1][2]. This verification is configured by adding specific properties to the maven-wrapper.properties file [1][3]. The supported checksum properties are: 1. distributionSha512Sum: Used to verify the integrity of the downloaded Maven distribution [4][5]. This was introduced because official Maven distributions provide SHA-512 checksums [4][6]. 2. wrapperSha512Sum: Used to verify the integrity of the maven-wrapper.jar file [4][5]. 3. distributionSha256Sum: An older property used to verify the Maven distribution using a SHA-256 checksum [7][1]. 4. wrapperSha256Sum: An older property used to verify the maven-wrapper.jar file using a SHA-256 checksum [7][1]. While the SHA-256 properties (distributionSha256Sum and wrapperSha256Sum) remain available for backward compatibility, the SHA-512 variants are preferred because they align with the checksums officially published by the Maven project [4][5]. The checksum values should be provided in hex notation, using only lowercase characters [1][3].

Citations:

Use distributionSha512Sum instead of distributionSha256Sum for Maven 3.9.16 integrity verification.

The file lacks a checksum property, so the Maven wrapper skips integrity validation of the downloaded archive—a supply-chain hardening gap. Apache Maven 3.9.16 does not publish SHA256 checksums; it officially provides SHA512 checksums at https://downloads.apache.org/maven/maven-3/3.9.16/binaries/apache-maven-3.9.16-bin.zip.sha512. Use distributionSha512Sum to align with the official distribution and Maven wrapper best practices.

🔧 Suggested change 
 wrapperVersion=3.3.4
 distributionType=only-script
 distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
+distributionSha512Sum=<sha512_from_official_maven_release>
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/.mvn/wrapper/maven-wrapper.properties` around lines 1 - 3, The
maven-wrapper.properties file lacks integrity verification for the downloaded
Maven distribution, creating a supply-chain security gap. Add a
distributionSha512Sum property to the file with the official SHA512 checksum
from
https://downloads.apache.org/maven/maven-3/3.9.16/binaries/apache-maven-3.9.16-bin.zip.sha512
to enable checksum validation. This aligns with Maven wrapper best practices and
ensures the downloaded archive matches the official distribution for Maven
3.9.16.

34 changes: 0 additions & 34 deletions backend/.project
View file
Open in desktop

This file was deleted.

4 changes: 0 additions & 4 deletions backend/.settings/org.eclipse.jdt.apt.core.prefs
View file
Open in desktop

This file was deleted.

9 changes: 0 additions & 9 deletions backend/.settings/org.eclipse.jdt.core.prefs
View file
Open in desktop

This file was deleted.

4 changes: 0 additions & 4 deletions backend/.settings/org.eclipse.m2e.core.prefs
View file
Open in desktop

This file was deleted.

Loading