title: How to enforce a strict Maven dependency policy (dependency chain attack)
body: <p>I would like to enforce a strict Maven dependency policy which goes beyond the basic <code>checksumPolicy=fail</code> approach. </p>
  
  <p>This is an attempt to <strong>provide protection against a modified release dependency which still has a valid digest value</strong> also known as a "dependency chain attack". </p>
  
  <p>This situation could arise from the following scenarios:</p>
  
  <ul>
  <li>the dependency has been updated, but the author has not updated the version number and managed to overwrite the earlier release (or their repo account has been compromised)</li>
  <li>a man-in-the-middle attack is in place (with on-the-fly rewriting/hashing)</li>
  <li>the repository itself has been compromised </li>
  </ul>
  
  <p>In discussions with other developers one approach to combat the above is to have a list of known MD5/SHA digests in the pom.xml and have Maven verify that the downloaded dependency has the same digest. This ensures that so long as the source code repository remains secure, any included dependencies that have been compromised will be detected.</p>
  
  <p>Thus my question is twofold:</p>
  
  <ol>
  <li>are there any alternative approaches that would work more efficiently?</li>
  <li>are there any existing implementations/plugins that do this job?</li>
  </ol>