Be fine with signatures of signatures of checksums of signatures of checksums of POMs

or various combinations of those

core/shared/src/main/scala/coursier/maven/MavenSource.scala

@@ -95,6 +95,8 @@ final case class MavenSource(
     }
   }
 
+  private val types = Map("sha1" -> "SHA-1", "md5" -> "MD5", "asc" -> "sig")
+
   private def artifactsKnownPublications(
     dependency: Dependency,
     project: Project,
@@ -134,40 +136,40 @@ final case class MavenSource(
       }
     }
 
-    def extensionIsExtra(publications: Seq[EnrichedPublication], ext: String, tpe: String): Seq[EnrichedPublication] = {
-
-      val (withExt, other) = publications.partition(_.publication.ext.endsWith("." + ext))
-
-      var withExtMap = withExt.map(p => (p.publication.classifier, p.publication.ext.stripSuffix("." + ext)) -> p).toMap
-
-      other.map { p =>
-        val key = (p.publication.classifier, p.publication.ext)
-        withExtMap.get(key).fold(p) { sigPub =>
-          withExtMap -= key
-          p.copy(
-            extra = p.extra + (tpe -> sigPub)
-          )
-        }
-      } ++ withExtMap.values
-    }
-
     def groupedEnrichedPublications(publications: Seq[Publication]): Seq[EnrichedPublication] = {
 
-      def helperSameName(publications: Seq[Publication]): Seq[EnrichedPublication] = {
+      def helper(publications: Seq[Publication]): Seq[EnrichedPublication] = {
 
-        val publications0 = publications.map { pub =>
-          EnrichedPublication(pub, Map())
+        var publications0 = publications
+          .map { pub =>
+            pub.ext -> EnrichedPublication(pub, Map())
+          }
+          .toMap
+
+        val byLength = publications0.toVector.sortBy(-_._1.length)
+
+        for {
+          (ext, _) <- byLength
+          idx = ext.lastIndexOf('.')
+          if idx >= 0
+          subExt = ext.substring(idx + 1)
+          baseExt = ext.substring(0, idx)
+          tpe <- types.get(subExt)
+          mainPub <- publications0.get(baseExt)
+        } {
+          val pub = publications0(ext)
+          publications0 += baseExt -> mainPub.copy(
+            extra = mainPub.extra + (tpe -> pub)
+          )
+          publications0 -= ext
         }
 
-        Seq("sha1" -> "SHA-1", "md5" -> "MD5", "asc" -> "sig").foldLeft(publications0) {
-          case (pub, (ext, tpe)) =>
-            extensionIsExtra(pub, ext, tpe)
-        }
+        publications0.values.toVector
       }
 
       publications
-        .groupBy(_.name)
-        .mapValues(helperSameName)
+        .groupBy(p => (p.name, p.classifier))
+        .mapValues(helper)
         .values
         .toVector
         .flatten

tests/shared/src/test/resources/resolutions/org.yaml/snakeyaml/1.17

@@ -0,0 +1 @@
+org.yaml:snakeyaml:1.17:compile

tests/shared/src/test/scala/coursier/test/CentralTests.scala

@@ -163,9 +163,14 @@ object CentralTests extends TestSuite {
     assert(res.conflicts.isEmpty)
     assert(res.isDone)
 
-    val artifacts = classifierOpt.fold(res.dependencyArtifacts)(c => res.dependencyClassifiersArtifacts(Seq(c))).map(_._2).filter { a =>
-      a.`type` == artifactType
-    }
+    val artifacts = classifierOpt
+      .fold(res.dependencyArtifacts)(c => res.dependencyClassifiersArtifacts(Seq(c)))
+      .map(_._2)
+      .filter {
+        if (artifactType == "*") _ => true
+        else
+          _.`type` == artifactType
+      }
 
     f(artifacts)
   }
@@ -630,6 +635,40 @@ object CentralTests extends TestSuite {
         extraRepo = Some(MavenRepository("https://repository.jboss.org/nexus/content/repositories/public"))
       )
     }
+
+    'signaturesOfSignatures - {
+      val mod = Module("org.yaml", "snakeyaml")
+      val ver = "1.17"
+
+      def hasSha1(a: Artifact) = a.extra.contains("SHA-1")
+      def hasMd5(a: Artifact) = a.extra.contains("MD5")
+      def hasSig(a: Artifact) = a.extra.contains("sig")
+      def sigHasSig(a: Artifact) = a.extra.get("sig").exists(hasSig)
+
+      * - resolutionCheck(mod, ver)
+
+      * - withArtifacts(mod, ver, "*") { artifacts =>
+
+        val jarOpt = artifacts.find(_.`type` == "bundle")
+        val pomOpt = artifacts.find(_.`type` == "pom")
+
+        if (artifacts.length != 2 || jarOpt.isEmpty || pomOpt.isEmpty)
+          artifacts.foreach(println)
+
+        assert(artifacts.length == 2)
+        assert(jarOpt.nonEmpty)
+        assert(pomOpt.nonEmpty)
+
+        assert(jarOpt.forall(hasSha1))
+        assert(pomOpt.forall(hasSha1))
+        assert(jarOpt.forall(hasMd5))
+        assert(pomOpt.forall(hasMd5))
+        assert(jarOpt.forall(hasSig))
+        assert(pomOpt.forall(hasSig))
+        assert(jarOpt.forall(sigHasSig))
+        assert(pomOpt.forall(sigHasSig))
+      }
+    }
   }
 
 }