[jira] [Commented] (CXF-8913) Avoid 3rd party maven repository for OpenSAML

["Thomas Beckers (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CXF-8913?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18107975#comment-18107975 ] 

Thomas Beckers commented on CXF-8913:
-------------------------------------

As a solution or workaround the JBoss community repo from Red Hat can be used instead: https://repository.jboss.org/org/opensaml/

> Avoid 3rd party maven repository for OpenSAML
> ---------------------------------------------
>
>                 Key: CXF-8913
>                 URL: https://issues.apache.org/jira/browse/CXF-8913
>             Project: CXF
>          Issue Type: Improvement
>          Components: WS-* Components
>    Affects Versions: 4.0.2
>            Reporter: Claus Ibsen
>            Assignee: Colm O hEigeartaigh
>            Priority: Major
>
> Apache CXF depends on OpenSAML from Apache WSSJ project
> However this commit causes wss4j to download JARs from NOT maven central but from
> https://build.shibboleth.net/nexus/content/groups/public
> https://github.com/apache/ws-wss4j/commit/e4a33efcb2b474a1da2b2c08f815b2718e111823
> Is there a way for Apache CXF to only use JARs from maven central. There is a trust issue when JARs are NOT downloaded from central.
> At Apache Camel we only download from maven central - except for camel-jira which sadly had to download from Atlassian. We are considering deprecating and removing this component for that reason.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)