You are viewing a plain text version of this content. The canonical link for it is here.
Posted to site-commits@maven.apache.org by sv...@apache.org on 2026/10/21 16:56:11 UTC
svn commit: r1939317 - in maven/website/content: . docs/3.10.0
Author: svn-site-role
Date: Wed Oct 21 16:56:10 2026
New Revision: 1939317
Log:
1f3c24f Document server repositoryOrigins in settings.xml (#1731)
Modified:
maven/website/content/docs/3.10.0/release-notes.html
maven/website/content/settings.html
Modified: maven/website/content/docs/3.10.0/release-notes.html
==============================================================================
--- maven/website/content/docs/3.10.0/release-notes.html Wed Oct 21 16:49:36 2026 (r1939316)
+++ maven/website/content/docs/3.10.0/release-notes.html Wed Oct 21 16:56:10 2026 (r1939317)
@@ -159,7 +159,7 @@
<li><a href="/guides/mini/guide-reproducible-builds.html">Reproducible Builds</a> are active by default: the Super POM now provides a default value for <code>project.build.outputTimestamp</code></li>
<li>new CLI options for fine-grained update policy control: <code>-UA</code> (force artifact updates only), <code>-UM</code> (force metadata updates only), <code>--artifacts-update-policy=<policy></code>, <code>--metadata-update-policy=<policy></code></li>
<li>a <code><server></code> in <code>settings.xml</code> can declare <code><aliases></code>, so that one set of credentials serves several server ids (see <a href="/settings.html">Introduction to Settings</a>)</li>
-<li>a <code><server></code> in <code>settings.xml</code> can declare <code><repositoryOrigins></code>, to state explicitly which repository origins its credentials may be used with</li>
+<li>a <code><server></code> in <code>settings.xml</code> can declare <code><repositoryOrigins></code>, to state explicitly which repository origins its credentials may be used with (see <a href="/settings.html#Server_Repository_Origins">Server Repository Origins</a>)</li>
<li>the reactor summary is complete again: every module is listed, including the skipped ones, and failures are reported last at error level, so they are easier to spot</li>
<li>a toolchain requested by a plugin, but misconfigured, now fails the build instead of silently falling back to the JDK running Maven</li>
<li><code>MAVEN_PROJECTBASEDIR</code> can be used in <code>.mvn/jvm.config</code> (<a href="https://github.com/apache/maven/pull/13115" class="externalLink">#13115</a>)</li>
@@ -207,18 +207,7 @@
<h3>Artifact and metadata validation in Resolver</h3>
<p>Resolver 2.x validates artifact and metadata coordinates, and rejects values that cannot be safely mapped to a repository layout. A build relying on non-conformant coordinates can be unblocked with <code>maven.resolver.validation</code> set to <code>mild</code> or <code>off</code>, but the coordinates should be fixed instead.</p></section><section><a id="Repository_credentials_are_scoped"></a>
<h3>Repository credentials are scoped</h3>
-<p>Credentials of a <code>settings.xml</code> server are only offered to repositories and mirrors whose origin Maven could associate with that server id. A repository declared in a profile that is activated through <code><activation></code> or <code>-P</code> contributes no origin, so its credentials have to be declared explicitly:</p>
-
-<pre class="prettyprint linenums"><code class="language-xml"><server>
- <id>internal</id>
- <username>u</username>
- <password>p</password>
- <repositoryOrigins>
- <repositoryOrigin>https://repo.example.org</repositoryOrigin>
- <repositoryOrigin>https://mirror.example.org:8443</repositoryOrigin>
- </repositoryOrigins>
-</server>
-</code></pre></section><section><a id="Plugin_validation"></a>
+<p>Credentials of a <code>settings.xml</code> server are only offered to repositories and mirrors whose origin Maven could associate with that server id. Origins Maven cannot securely associate via id can be declared with <code><repositoryOrigins></code>, see <a href="/settings.html#Server_Repository_Origins">Server Repository Origins</a>.</p></section><section><a id="Plugin_validation"></a>
<h3>Plugin validation</h3>
<p>Plugins and extensions used by your build are checked against Maven supported APIs and conventions: this “plugin validation” may report WARNINGs at the end of your build. See <a href="../../guides/plugins/validation/">plugin validation documentation</a> to better understand what to do when your build suffers from such warnings.</p></section><section><a id="Reproducible_Builds"></a>
<h3>Reproducible Builds</h3>
Modified: maven/website/content/settings.html
==============================================================================
--- maven/website/content/settings.html Wed Oct 21 16:49:36 2026 (r1939316)
+++ maven/website/content/settings.html Wed Oct 21 16:56:10 2026 (r1939317)
@@ -181,6 +181,7 @@
<li><a href="#Servers">Servers</a>
<ul>
<li><a href="#Server_Aliases">Server Aliases</a></li>
+<li><a href="#Server_Repository_Origins">Server Repository Origins</a></li>
<li><a href="#Password_Encryption">Password Encryption</a></li></ul></li>
<li><a href="#Mirrors">Mirrors</a></li>
<li><a href="#Proxies">Proxies</a></li>
@@ -310,7 +311,55 @@
<li><strong>aliases</strong>: For each <code>alias</code>, Maven creates an additional <code>server</code> entry with the same configuration as the original one, but with the <code>id</code> replaced by the alias and with an empty <code>aliases</code> list. In the example above, the servers <code>company-releases</code>, <code>company-snapshots</code> and <code>company-mirror</code> are available at runtime, all use the same credentials.</li>
</ul>
<p>The additional servers are created in memory when the effective settings are built, so they are visible to Maven and plugins like any other server declared in <code>settings.xml</code>: you can see them with <code>mvn help:effective-settings</code>.</p>
-<p>An alias must not be empty, and it should be unique across all server IDs and aliases. Otherwise Maven reports a warning.</p></section><section><a id="Password_Encryption"></a>
+<p>An alias must not be empty, and it should be unique across all server IDs and aliases. Otherwise Maven reports a warning.</p></section><section><a id="Server_Repository_Origins"></a>
+<h4>Server Repository Origins</h4>
+<p>Since Maven 3.10.0 and 4.0.0, the credentials of a server are bound to the origins (scheme, host and port) of the repositories and mirrors declared with the same ID in <code>settings.xml</code>.</p>
+<p>When Maven starts, it takes into account only the repositories from <code>settings.xml</code> profiles listed in <code><activeProfiles></code> and mirrors. Repositories from other profiles, and repositories declared in a <code>pom.xml</code> (in <code>repositories</code>, <code>pluginRepositories</code> or <code>distributionManagement</code>), are not known at that time. For such a repository, Maven reports a warning, or refuses the credentials when <code>maven.repository.credentialScope=strict</code> is set.</p>
+<p>The binding protects your credentials: before, Maven matched credentials only by server ID, so any <code>pom.xml</code>, including the POM of a dependency or a parent, could declare a repository with the same ID pointing to another host and receive your username and password. Now, once Maven knows the hosts of a server ID, its credentials are sent only to them, and <code>repositoryOrigins</code> lets you add the hosts Maven cannot find by itself.</p>
+<p>For such repositories, a server (settings model <code>1.3.0</code>) can declare a list of <code>repositoryOrigins</code> its credentials may be used with:</p>
+
+<pre class="prettyprint linenums"><code class="language-xml"><settings xmlns="http://maven.apache.org/SETTINGS/1.3.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.3.0 https://maven.apache.org/xsd/settings-1.3.0.xsd">
+ ...
+ <servers>
+ <server>
+ <id>company-releases</id>
+ <username>my_login</username>
+ <password>my_password</password>
+ <repositoryOrigins>
+ <repositoryOrigin>https://repo.example.com</repositoryOrigin>
+ <repositoryOrigin>https://mirror.example.com:8443</repositoryOrigin>
+ </repositoryOrigins>
+ </server>
+ </servers>
+ ...
+</settings>
+</code></pre>
+<ul>
+
+<li><strong>repositoryOrigins</strong>: Each <code>repositoryOrigin</code> is written as <code>scheme://host</code> or <code>scheme://host:port</code>. It is an origin, not a full repository URL. If a path, query or fragment is given, Maven reports a warning and ignores it. A value without a scheme or host, or with user information, is reported as an error. The comparison is case-insensitive, and the default ports <code>80</code> (http) and <code>443</code> (https) are the same as no port.</li>
+</ul>
+<p>The declared origins are added to the origins Maven finds from repositories and mirrors. Nothing is replaced, so existing configurations keep working. Servers created from <a href="#Server_Aliases">aliases</a> get the same <code>repositoryOrigins</code>.</p>
+<p>When a server has at least one origin, from repositories, mirrors or <code>repositoryOrigins</code>, its credentials are not sent to a repository with the same ID at another origin.</p>
+<p>The binding is controlled by the <code>maven.repository.credentialScope</code> user property:</p>
+<table class="table table-striped">
+<thead>
+<tr class="a">
+<th>Value</th>
+<th>Description</th></tr></thead><tbody>
+<tr class="b">
+<td><code>origin</code> (default)</td>
+<td>Credentials are bound to the known origins. A server without any origin works as before, with a warning.</td></tr>
+<tr class="a">
+<td><code>strict</code></td>
+<td>Credentials are bound to the known origins. A server without any origin is not used.</td></tr>
+<tr class="b">
+<td><code>id</code></td>
+<td>Previous behavior: credentials are matched by server ID only.</td></tr></tbody>
+</table>
+
+<p>For Maven 4, <code>repositoryOrigins</code> in project settings (<code>.mvn/settings.xml</code>) are ignored with a warning, like credentials are, so a project cannot widen the set of hosts your credentials are sent to.</p>
+<p><em>Note:</em> The binding applies only to credentials used by Maven Resolver, for example when artifacts are downloaded or deployed with the <a href="/plugins/maven-deploy-plugin/">Maven Deploy Plugin</a>. Plugins that read a server from <code>settings.xml</code> directly, for example the <a href="/plugins/maven-release-plugin/">Maven Release Plugin</a> for SCM credentials, are not affected by it.</p></section><section><a id="Password_Encryption"></a>
<h4>Password Encryption</h4>
<p>Since Maven 2.1.0, server password and passphrase encryption is available and strongly encouraged: See details on <a href="./guides/mini/guide-encryption.html">Guide to Password Encryption</a>.</p></section></section><section><a id="Mirrors"></a>
<h3>Mirrors</h3>