paulp/sbt-extras — pull request #58 by gildegoma (2013-08-27 11:34:19+00:00)
Title: ~/.sbt/launchers/0.13.0/sbt-launch.jar can be usurped

Since f525931ca50e2196d04785db16a67738715c43c5 ([here](https://github.com/paulp/sbt-extras/blob/f525931ca50e2196d04785db16a67738715c43c5/sbt#L224) in particular), `~/.sbt/launchers/0.13.0/sbt-launch.jar` can be "spoofed" by an erroneous launcher version:

```
Downloading sbt launcher 0.12.4:
From http://typesafe.artifactoryonline.com/typesafe/ivy-releases/org.scala-sbt/sbt-launch/0.12.4/sbt-launch.jar
To /home/vagrant/.sbt/launchers/0.13.0/sbt-launch.jar
```

By lack of time (and confidence), I didn't provide any fixing PR (yet). I'm not sure if previous launchers (like 0.12.x, 0.11.x,...) are still worth to be acquired, since latest (currently 0.13.0) is supposed to be used for older sbt versions as well (see `jar_file` case matches).