[jira] [Updated] (MASSEMBLY-951) assembly plugin attempts to download dependencies over unsecure http protocol

["Michael Osipov (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/MASSEMBLY-951?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Michael Osipov updated MASSEMBLY-951:
-------------------------------------
    Fix Version/s: waiting-for-feedback

> assembly plugin attempts to download dependencies over unsecure http protocol
> -----------------------------------------------------------------------------
>
>                 Key: MASSEMBLY-951
>                 URL: https://issues.apache.org/jira/browse/MASSEMBLY-951
>             Project: Maven Assembly Plugin
>          Issue Type: Bug
>    Affects Versions: 3.3.0
>            Reporter: Martin
>            Priority: Major
>             Fix For: waiting-for-feedback
>
>
> When I build my project, Maven downloads stuff from repositories I haven't defined anywhere in my pom.xml nor settings.xml:
>  
> ```
> [INFO] --- maven-assembly-plugin:3.3.0:single (make-assembly) @ ghd-poc ---
> [INFO] Reading assembly descriptor: src/main/assembly/uberjar.xml
> [INFO] Reading assembly descriptor: src/main/assembly/zip.xml
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/flow-client/2.5.0.alpha2/flow-client-2.5.0.alpha2.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/flow-client/2.5.0.alpha2/flow-client-2.5.0.alpha2.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/flow-html-components/2.5.0.alpha2/flow-html-components-2.5.0.alpha2.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/flow-html-components/2.5.0.alpha2/flow-html-components-2.5.0.alpha2.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/flow-data/2.5.0.alpha2/flow-data-2.5.0.alpha2.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/flow-data/2.5.0.alpha2/flow-data-2.5.0.alpha2.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/flow-dnd/2.5.0.alpha2/flow-dnd-2.5.0.alpha2.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/flow-dnd/2.5.0.alpha2/flow-dnd-2.5.0.alpha2.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-lumo-theme/2.5.0.alpha2/vaadin-lumo-theme-2.5.0.alpha2.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-lumo-theme/2.5.0.alpha2/vaadin-lumo-theme-2.5.0.alpha2.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-material-theme/2.5.0.alpha2/vaadin-material-theme-2.5.0.alpha2.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-material-theme/2.5.0.alpha2/vaadin-material-theme-2.5.0.alpha2.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-accordion-flow/14.5.0.alpha3/vaadin-accordion-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-accordion-flow/14.5.0.alpha3/vaadin-accordion-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-avatar-flow/14.5.0.alpha3/vaadin-avatar-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-avatar-flow/14.5.0.alpha3/vaadin-avatar-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-button-flow/14.5.0.alpha3/vaadin-button-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-button-flow/14.5.0.alpha3/vaadin-button-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-checkbox-flow/14.5.0.alpha3/vaadin-checkbox-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-checkbox-flow/14.5.0.alpha3/vaadin-checkbox-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-combo-box-flow/14.5.0.alpha3/vaadin-combo-box-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-combo-box-flow/14.5.0.alpha3/vaadin-combo-box-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-custom-field-flow/14.5.0.alpha3/vaadin-custom-field-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-custom-field-flow/14.5.0.alpha3/vaadin-custom-field-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-date-picker-flow/14.5.0.alpha3/vaadin-date-picker-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-date-picker-flow/14.5.0.alpha3/vaadin-date-picker-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-date-time-picker-flow/14.5.0.alpha3/vaadin-date-time-picker-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-date-time-picker-flow/14.5.0.alpha3/vaadin-date-time-picker-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-details-flow/14.5.0.alpha3/vaadin-details-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-details-flow/14.5.0.alpha3/vaadin-details-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-time-picker-flow/14.5.0.alpha3/vaadin-time-picker-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-time-picker-flow/14.5.0.alpha3/vaadin-time-picker-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-select-flow/14.5.0.alpha3/vaadin-select-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-select-flow/14.5.0.alpha3/vaadin-select-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-dialog-flow/14.5.0.alpha3/vaadin-dialog-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-dialog-flow/14.5.0.alpha3/vaadin-dialog-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-form-layout-flow/14.5.0.alpha3/vaadin-form-layout-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-form-layout-flow/14.5.0.alpha3/vaadin-form-layout-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-grid-flow/14.5.0.alpha3/vaadin-grid-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-grid-flow/14.5.0.alpha3/vaadin-grid-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-icons-flow/14.5.0.alpha3/vaadin-icons-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-icons-flow/14.5.0.alpha3/vaadin-icons-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-iron-list-flow/14.5.0.alpha3/vaadin-iron-list-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-iron-list-flow/14.5.0.alpha3/vaadin-iron-list-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-list-box-flow/14.5.0.alpha3/vaadin-list-box-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-list-box-flow/14.5.0.alpha3/vaadin-list-box-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-login-flow/14.5.0.alpha3/vaadin-login-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-login-flow/14.5.0.alpha3/vaadin-login-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-ordered-layout-flow/14.5.0.alpha3/vaadin-ordered-layout-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-ordered-layout-flow/14.5.0.alpha3/vaadin-ordered-layout-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-progress-bar-flow/14.5.0.alpha3/vaadin-progress-bar-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-progress-bar-flow/14.5.0.alpha3/vaadin-progress-bar-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-radio-button-flow/14.5.0.alpha3/vaadin-radio-button-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-radio-button-flow/14.5.0.alpha3/vaadin-radio-button-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-split-layout-flow/14.5.0.alpha3/vaadin-split-layout-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-split-layout-flow/14.5.0.alpha3/vaadin-split-layout-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-tabs-flow/14.5.0.alpha3/vaadin-tabs-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-tabs-flow/14.5.0.alpha3/vaadin-tabs-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-text-field-flow/14.5.0.alpha3/vaadin-text-field-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-text-field-flow/14.5.0.alpha3/vaadin-text-field-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-upload-flow/14.5.0.alpha3/vaadin-upload-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-upload-flow/14.5.0.alpha3/vaadin-upload-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-notification-flow/14.5.0.alpha3/vaadin-notification-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-notification-flow/14.5.0.alpha3/vaadin-notification-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-app-layout-flow/14.5.0.alpha3/vaadin-app-layout-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-app-layout-flow/14.5.0.alpha3/vaadin-app-layout-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-context-menu-flow/14.5.0.alpha3/vaadin-context-menu-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-context-menu-flow/14.5.0.alpha3/vaadin-context-menu-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-menu-bar-flow/14.5.0.alpha3/vaadin-menu-bar-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-menu-bar-flow/14.5.0.alpha3/vaadin-menu-bar-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-board-flow/14.5.0.alpha3/vaadin-board-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-board-flow/14.5.0.alpha3/vaadin-board-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-charts-flow/14.5.0.alpha3/vaadin-charts-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-charts-flow/14.5.0.alpha3/vaadin-charts-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-confirm-dialog-flow/14.5.0.alpha3/vaadin-confirm-dialog-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-confirm-dialog-flow/14.5.0.alpha3/vaadin-confirm-dialog-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-cookie-consent-flow/14.5.0.alpha3/vaadin-cookie-consent-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-cookie-consent-flow/14.5.0.alpha3/vaadin-cookie-consent-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-crud-flow/14.5.0.alpha3/vaadin-crud-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-crud-flow/14.5.0.alpha3/vaadin-crud-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-grid-pro-flow/14.5.0.alpha3/vaadin-grid-pro-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-grid-pro-flow/14.5.0.alpha3/vaadin-grid-pro-flow-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-rich-text-editor-flow/14.5.0.alpha3/vaadin-rich-text-editor-flow-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-rich-text-editor-flow/14.5.0.alpha3/vaadin-rich-text-editor-flow-14.5.0.alpha3.pom
> [INFO] Building jar: /home/mavi/work/ghd/ghd-poc/target/ghd-poc-1.0-SNAPSHOT-uberjar.jar
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin/14.5.0.alpha3/vaadin-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin/14.5.0.alpha3/vaadin-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/vaadin-core/14.5.0.alpha3/vaadin-core-14.5.0.alpha3.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/vaadin-core/14.5.0.alpha3/vaadin-core-14.5.0.alpha3.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/flow-server/2.5.0.alpha2/flow-server-2.5.0.alpha2.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/flow-server/2.5.0.alpha2/flow-server-2.5.0.alpha2.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/flow-lit-template/2.5.0.alpha2/flow-lit-template-2.5.0.alpha2.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/flow-lit-template/2.5.0.alpha2/flow-lit-template-2.5.0.alpha2.pom
> Downloading from codehaus: http://repository.codehaus.org/com/vaadin/flow-push/2.5.0.alpha2/flow-push-2.5.0.alpha2.pom
> Downloading from codehaus-snapshots: http://snapshots.repository.codehaus.org/com/vaadin/flow-push/2.5.0.alpha2/flow-push-2.5.0.alpha2.pom
> Downloading from glassfish-repository: http://download.java.net/maven/glassfish/com/vaadin/vaadin-text-field-flow/14.5.0.alpha3/vaadin-text-field-flow-14.5.0.alpha3.pom
> Downloading from glassfish-repository: http://download.java.net/maven/glassfish/com/vaadin/vaadin-upload-flow/14.5.0.alpha3/vaadin-upload-flow-14.5.0.alpha3.pom
> Downloading from glassfish-repository: http://download.java.net/maven/glassfish/com/vaadin/vaadin-notification-flow/14.5.0.alpha3/vaadin-notification-flow-14.5.0.alpha3.pom
> Downloading from glassfish-repository: http://download.java.net/maven/glassfish/com/vaadin/vaadin-app-layout-flow/14.5.0.alpha3/vaadin-app-layout-flow-14.5.0.alpha3.pom
> Downloading from glassfish-repository: http://download.java.net/maven/glassfish/com/vaadin/vaadin-context-menu-flow/14.5.0.alpha3/vaadin-context-menu-flow-14.5.0.alpha3.pom
> Downloading from glassfish-repository: http://download.java.net/maven/glassfish/com/vaadin/vaadin-menu-bar-flow/14.5.0.alpha3/vaadin-menu-bar-flow-14.5.0.alpha3.pom
> Downloading from glassfish-repository: http://download.java.net/maven/glassfish/com/vaadin/vaadin-board-flow/14.5.0.alpha3/vaadin-board-flow-14.5.0.alpha3.pom
> Downloading from glassfish-repository: http://download.java.net/maven/glassfish/com/vaadin/vaadin-charts-flow/14.5.0.alpha3/vaadin-charts-flow-14.5.0.alpha3.pom
> Downloading from glassfish-repository: http://download.java.net/maven/glassfish/com/vaadin/vaadin-confirm-dialog-flow/14.5.0.alpha3/vaadin-confirm-dialog-flow-14.5.0.alpha3.pom
> Downloading from glassfish-repository: http://download.java.net/maven/glassfish/com/vaadin/vaadin-cookie-consent-flow/14.5.0.alpha3/vaadin-cookie-consent-flow-14.5.0.alpha3.pom
> ```
>  
> I have no idea where those repositories came from; it's slowing the build tremendously and is a huge security risk (since http is prone to hijacks, MITM attacks and other issues).



--
This message was sent by Atlassian Jira
(v8.3.4#803005)