ci: unbreak the 1EdTech OB3 validator image build

DanubeTech's public Maven repo serves verifiable-credentials-java and
uni-resolver-client without checksum files, while the upstream POM pins
checksumPolicy=fail on that repository. Maven 3.9+ then aborts with
"Checksum validation failed, no checksums available" and the nightly
conformance workflow never starts the suite.

Relax checksumPolicy only for danubetech-public and pass --lax-checksums.

Fixes #329

Author: luisgf

tests/conformance/Dockerfile.ob3

@@ -9,14 +9,24 @@ ARG VALIDATOR_REF=main
 
 FROM maven:3.9-eclipse-temurin-17 AS build
 ARG VALIDATOR_REF
+COPY relax-danubetech-checksums.awk /tmp/relax-danubetech-checksums.awk
 RUN git clone --depth 1 --branch "${VALIDATOR_REF}" \
         https://github.com/1EdTech/digital-credentials-public-validator.git /src
 WORKDIR /src
 # libsodium is needed by the crypto libs even during test-compile; skip tests
 # for image build speed (we exercise the service through its REST API instead).
+#
+# DanubeTech's public Nexus (verifiable-credentials-java, uni-resolver-client)
+# serves the artifacts but no .sha1/.md5 companions. The upstream POM pins
+# checksumPolicy=fail on that repo, so Maven 3.9+ aborts with
+# "Checksum validation failed, no checksums available". Relax only that
+# repository; 1EdTech's own Nexus stays strict. --lax-checksums is a second
+# belt if a future POM reformats the XML and the awk no longer matches.
 RUN apt-get update && apt-get install -y --no-install-recommends libsodium23 \
     && rm -rf /var/lib/apt/lists/* \
-    && mvn -q -DskipTests package
+    && awk -f /tmp/relax-danubetech-checksums.awk pom.xml > pom.xml.new \
+    && mv pom.xml.new pom.xml \
+    && mvn --lax-checksums -q -DskipTests package
 
 FROM eclipse-temurin:17-jdk
 RUN apt-get update && apt-get install -y --no-install-recommends libsodium23 \

tests/conformance/README.md

@@ -74,7 +74,12 @@ header) so verification needs no DID resolution or outbound network. Results:
 
 - `docker-compose.yml` — both validators as services.
 - `Dockerfile.ob3` — multi-stage (Maven build + runtime) for the OB 3.0
-  validator, whose upstream Dockerfile assumes a pre-built jar.
+  validator, whose upstream Dockerfile assumes a pre-built jar. The Maven
+  stage rewrites `checksumPolicy` on the `danubetech-public` repository to
+  `ignore`: that Nexus serves `verifiable-credentials-java` / `uni-resolver-client`
+  without `.sha1`/`.md5` companions, and the upstream POM pins `fail`, which
+  makes Maven 3.9+ abort the image build.
+- `relax-danubetech-checksums.awk` — the POM rewrite used by `Dockerfile.ob3`.
 - `conftest.py` — service-URL fixtures (skip if down) + an ephemeral static
   file server.
 - `test_official_validators.py` — the opt-in tests.

tests/conformance/relax-danubetech-checksums.awk

@@ -0,0 +1,24 @@
+# Rewrite checksumPolicy=fail -> ignore only inside the danubetech-public
+# <repository> block. DanubeTech's Nexus serves the jars but no .sha1/.md5
+# companions, so Maven 3.9+ otherwise aborts with
+# "Checksum validation failed, no checksums available".
+BEGIN { in_repo = 0; buf = "" }
+/<repository>/ {
+    in_repo = 1
+    buf = $0
+    next
+}
+in_repo {
+    buf = buf "\n" $0
+    if ($0 ~ /<\/repository>/) {
+        if (buf ~ /<id>danubetech-public<\/id>/) {
+            gsub(/<checksumPolicy>fail<\/checksumPolicy>/, \
+                 "<checksumPolicy>ignore</checksumPolicy>", buf)
+        }
+        print buf
+        buf = ""
+        in_repo = 0
+    }
+    next
+}
+{ print }