You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@maven.apache.org by ma...@barclays.com.INVALID on 2021/12/08 15:07:31 UTC

request for documentation update about mirrors

I hope this is the right mailing list; if I not, would appreciate a redirect.
In the release notes for maven 3.8.1, here:
https://maven.apache.org/docs/3.8.1/release-notes.html
There is a helpfully titled section "How to fix when I get a HTTP repository blocked?"
https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked
It mentions 2 options:

*         Update to a newer version of the artifact you're fetching, which is presumably available over https

*         Define a mirror in your settings, which links to this page:
https://maven.apache.org/guides/mini/guide-mirror-settings.html

The first option is not helpful, since we are using a settings.xml which lists many http-only repositories, including one with an id of "central".
Since these are all on our internal network, the usual concerns about security don't apply, or at least not in full force like they would on the public internet.

(We don't let maven access the public internet.  If a fellow coworker is trying to hijack my maven downloads, I suppose they might succeed.  We'll keep taking that risk for now :))

That brings us to the second option: create a mirror.  Unfortunately, the linked page doesn't even mention anything about blocking and unblocking.
In fact, I can't find the <blocked> tag documented anywhere, though perhaps I'm looking in the wrong places.

What I'd ideally like to see is a way to "undo" the mirror defined in the global settings in one fell swoop.
That is, I do NOT want to go through the repos listed in our repositories, and then tediously create a mirror for each of them, one by one, and then remember to keep the two lists in sync if anything changes.

So: can the documentation be updated to mention anything about unblocking, and is there any way to do what I want?

Thanks,
Mark.

_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
�This message is for information purposes only, it is not a recommendation, advice, offer or solicitation to buy or sell a product or service nor an official confirmation of any transaction. It is directed at persons who are professionals and is not intended for retail customer use. Intended for recipient only. This message is subject to the terms at: www.barclays.com/emaildisclaimer.

For important disclosures, please see: www.barclays.com/salesandtradingdisclaimer regarding market commentary from Barclays Sales and/or Trading, who are active market participants; https://www.investmentbank.barclays.com/disclosures/barclays-global-markets-disclosures.html regarding our standard terms for the Investment Bank of Barclays where we trade with you in principal-to-principal wholesale markets transactions; and in respect of Barclays Research, including disclosures relating to specific issuers, please see http://publicresearch.barclays.com.�  
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
If you are incorporated or operating in Australia, please see https://www.home.barclays/disclosures/importantapacdisclosures.html for important disclosure.
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
How we use personal information  see our privacy notice https://www.investmentbank.barclays.com/disclosures/personalinformationuse.html 
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________

Re: request for documentation update about mirrors

Posted by Niranjan Rao <nh...@gmail.com>.

It sounds like you have multiple repositories defined on same nexus 
instance. This is similar to setup we have. We have repositories for 
third party libraries we use as well as a mirror of maven central for 
the stuff we need.

Key difference between the setup you have and my setup is we have one 
(internally) public repository and other repositories are member of that 
repository. All the developers always use that public repository rather 
than adding multiple repository.

Repositories are managed by appropriate people who care about what 
contents get into repository.

If it helps I have following entries in my settings.xml

  <mirrors>
     <mirror>
       <id>nexus</id>
       <mirrorOf>*</mirrorOf>
       <url>https://<url>/nexus/repository/<only public repo>/</url>
     </mirror>
   </mirrors>

Maven channels everything through nexus and nexus serves it based on rules.

Regards,

Niranjan

On 12/8/21 4:25 PM, mark.yagnatinsky@barclays.com.INVALID wrote:
> Sorry for broken threading; I wasn't subscribed to the mailing list so I never got your reply; not sure how to fix it now.  Now I'm subscribed.
>
> Yes, we are using nexus.  One of our nexus servers is even using HTTPS.  The rest are not.
> As for why we have "many" ... I'm not entirely sure.  It was like that when I got here.
> I could ask around, but I'm not sure how much it matters.  Could be
>
> *         Historical reasons
>
> *         Bureaucratic reasons
>
> *         Or maybe even very good reasons that I happen to not know.
> As it happens, many of these "separate" nexus repositories are on the same server, but maven treats them all as if they are distinct, because they have different paths.  E.g. one might be
> http://nexus.example.com:8080/nexus/content/groups/main/
> while another might be
> http://nexus.example.com:8080/nexus/content/repositories/UPLOAD-EXTERNAL-RELEASES/
>
> Not sure if any of this answers your question.
>
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
> “This message is for information purposes only, it is not a recommendation, advice, offer or solicitation to buy or sell a product or service nor an official confirmation of any transaction. It is directed at persons who are professionals and is not intended for retail customer use. Intended for recipient only. This message is subject to the terms at: www.barclays.com/emaildisclaimer.
>
> For important disclosures, please see: www.barclays.com/salesandtradingdisclaimer regarding market commentary from Barclays Sales and/or Trading, who are active market participants; https://www.investmentbank.barclays.com/disclosures/barclays-global-markets-disclosures.html regarding our standard terms for the Investment Bank of Barclays where we trade with you in principal-to-principal wholesale markets transactions; and in respect of Barclays Research, including disclosures relating to specific issuers, please see http://publicresearch.barclays.com.”
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
> If you are incorporated or operating in Australia, please see https://www.home.barclays/disclosures/importantapacdisclosures.html for important disclosure.
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
> How we use personal information  see our privacy notice https://www.investmentbank.barclays.com/disclosures/personalinformationuse.html
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
>


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org

Re: request for documentation update about mirrors

Posted by Greg Chabala <gr...@gmail.com>.

I can't speak to your question about disabling the https requirement,
though my guess is that will be impossible and/or unpopular, likely by
design. If you could just turn it off, some people would just turn it off,
which defeats the purpose.

The root of my questions is that if your Nexus is configured properly,
https shouldn't be an issue to begin with.

You should get in touch with your Nexus admin, get familiar with the
historical and/or bureaucratic reasons for what exists, and get one of them
configured to meet your needs, e.g. serving over https, a group that
contains the aggregate of all the repos your settings.xml is referencing.
They are likely already familiar with the need for https access.

On Wed, Dec 8, 2021 at 6:26 PM <ma...@barclays.com.invalid>
wrote:

> Sorry for broken threading; I wasn't subscribed to the mailing list so I
> never got your reply; not sure how to fix it now.  Now I'm subscribed.
>
> Yes, we are using nexus.  One of our nexus servers is even using HTTPS.
> The rest are not.
> As for why we have "many" ... I'm not entirely sure.  It was like that
> when I got here.
> I could ask around, but I'm not sure how much it matters.  Could be
>
> *         Historical reasons
>
> *         Bureaucratic reasons
>
> *         Or maybe even very good reasons that I happen to not know.
> As it happens, many of these "separate" nexus repositories are on the same
> server, but maven treats them all as if they are distinct, because they
> have different paths.  E.g. one might be
> http://nexus.example.com:8080/nexus/content/groups/main/
> while another might be
>
> http://nexus.example.com:8080/nexus/content/repositories/UPLOAD-EXTERNAL-RELEASES/
>
> Not sure if any of this answers your question.
>
>
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
> “This message is for information purposes only, it is not a
> recommendation, advice, offer or solicitation to buy or sell a product or
> service nor an official confirmation of any transaction. It is directed at
> persons who are professionals and is not intended for retail customer use.
> Intended for recipient only. This message is subject to the terms at:
> www.barclays.com/emaildisclaimer.
>
> For important disclosures, please see:
> www.barclays.com/salesandtradingdisclaimer regarding market commentary
> from Barclays Sales and/or Trading, who are active market participants;
> https://www.investmentbank.barclays.com/disclosures/barclays-global-markets-disclosures.html
> regarding our standard terms for the Investment Bank of Barclays where we
> trade with you in principal-to-principal wholesale markets transactions;
> and in respect of Barclays Research, including disclosures relating to
> specific issuers, please see http://publicresearch.barclays.com.”
>
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
> If you are incorporated or operating in Australia, please see
> https://www.home.barclays/disclosures/importantapacdisclosures.html for
> important disclosure.
>
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
> How we use personal information  see our privacy notice
> https://www.investmentbank.barclays.com/disclosures/personalinformationuse.html
>
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
>

RE: request for documentation update about mirrors

Posted by ma...@barclays.com.INVALID.

Sorry for broken threading; I wasn't subscribed to the mailing list so I never got your reply; not sure how to fix it now. Now I'm subscribed.

Yes, we are using nexus. One of our nexus servers is even using HTTPS. The rest are not.
As for why we have "many" ... I'm not entirely sure. It was like that when I got here.
I could ask around, but I'm not sure how much it matters. Could be

* Historical reasons

* Bureaucratic reasons

* Or maybe even very good reasons that I happen to not know.
As it happens, many of these "separate" nexus repositories are on the same server, but maven treats them all as if they are distinct, because they have different paths. E.g. one might be
http://nexus.example.com:8080/nexus/content/groups/main/
while another might be
http://nexus.example.com:8080/nexus/content/repositories/UPLOAD-EXTERNAL-RELEASES/

Not sure if any of this answers your question.

_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
�This message is for information purposes only, it is not a recommendation, advice, offer or solicitation to buy or sell a product or service nor an official confirmation of any transaction. It is directed at persons who are professionals and is not intended for retail customer use. Intended for recipient only. This message is subject to the terms at: www.barclays.com/emaildisclaimer.

For important disclosures, please see: www.barclays.com/salesandtradingdisclaimer regarding market commentary from Barclays Sales and/or Trading, who are active market participants; https://www.investmentbank.barclays.com/disclosures/barclays-global-markets-disclosures.html regarding our standard terms for the Investment Bank of Barclays where we trade with you in principal-to-principal wholesale markets transactions; and in respect of Barclays Research, including disclosures relating to specific issuers, please see http://publicresearch.barclays.com.�
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
If you are incorporated or operating in Australia, please see https://www.home.barclays/disclosures/importantapacdisclosures.html for important disclosure.
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
How we use personal information see our privacy notice https://www.investmentbank.barclays.com/disclosures/personalinformationuse.html
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________

Re: request for documentation update about mirrors

Posted by Greg Chabala <gr...@gmail.com>.

>
> since we are using a settings.xml which lists many http-only repositories,
> including one with an id of "central".
> Since these are all on our internal network
>

 We don't let maven access the public internet


As your repositories are all internal, and you don't let maven connect to
the public internet, what are you using to host internal repos? Nexus,
Artifactory? Either should provide https out of the box.

Also, why 'many' repositories? Your internal repository manager ought to
cache, mirror and aggregate, and be the single repo you need to reference.

Greg Chabala

On Wed, Dec 8, 2021 at 11:39 AM <ma...@barclays.com.invalid>
wrote:

> I hope this is the right mailing list; if I not, would appreciate a
> redirect.
> In the release notes for maven 3.8.1, here:
> https://maven.apache.org/docs/3.8.1/release-notes.html
> There is a helpfully titled section "How to fix when I get a HTTP
> repository blocked?"
>
> https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked
> It mentions 2 options:
>
> *         Update to a newer version of the artifact you're fetching, which
> is presumably available over https
>
> *         Define a mirror in your settings, which links to this page:
> https://maven.apache.org/guides/mini/guide-mirror-settings.html
>
> The first option is not helpful, since we are using a settings.xml which
> lists many http-only repositories, including one with an id of "central".
> Since these are all on our internal network, the usual concerns about
> security don't apply, or at least not in full force like they would on the
> public internet.
>
> (We don't let maven access the public internet.  If a fellow coworker is
> trying to hijack my maven downloads, I suppose they might succeed.  We'll
> keep taking that risk for now :))
>
> That brings us to the second option: create a mirror.  Unfortunately, the
> linked page doesn't even mention anything about blocking and unblocking.
> In fact, I can't find the <blocked> tag documented anywhere, though
> perhaps I'm looking in the wrong places.
>
> What I'd ideally like to see is a way to "undo" the mirror defined in the
> global settings in one fell swoop.
> That is, I do NOT want to go through the repos listed in our repositories,
> and then tediously create a mirror for each of them, one by one, and then
> remember to keep the two lists in sync if anything changes.
>
> So: can the documentation be updated to mention anything about unblocking,
> and is there any way to do what I want?
>
> Thanks,
> Mark.
>
>
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
> “This message is for information purposes only, it is not a
> recommendation, advice, offer or solicitation to buy or sell a product or
> service nor an official confirmation of any transaction. It is directed at
> persons who are professionals and is not intended for retail customer use.
> Intended for recipient only. This message is subject to the terms at:
> www.barclays.com/emaildisclaimer.
>
> For important disclosures, please see:
> www.barclays.com/salesandtradingdisclaimer regarding market commentary
> from Barclays Sales and/or Trading, who are active market participants;
> https://www.investmentbank.barclays.com/disclosures/barclays-global-markets-disclosures.html
> regarding our standard terms for the Investment Bank of Barclays where we
> trade with you in principal-to-principal wholesale markets transactions;
> and in respect of Barclays Research, including disclosures relating to
> specific issuers, please see http://publicresearch.barclays.com.”
>
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
> If you are incorporated or operating in Australia, please see
> https://www.home.barclays/disclosures/importantapacdisclosures.html for
> important disclosure.
>
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
> How we use personal information  see our privacy notice
> https://www.investmentbank.barclays.com/disclosures/personalinformationuse.html
>
> _________________________________________________________________________________________________________________________________________________________________________________________________________________________________
>

RE: request for documentation update about mirrors

Posted by ma...@barclays.com.INVALID.

True, it is "just a file". It was actually my first idea, before I emailed this list. But though it's "just a file", it's a file I'd have to keep editing every time I updated maven.
It's likewise a file everyone else on the team needs to be taught to edit every time they update maven.

Fun fact: the way I discovered this issue is via an accidental maven update. I was using the maven bundled with my IDE. I then updated my IDE.
The release "highlights" page for the IDE did not even mention it comes bundled with a new maven version.

So, another way to describe editing this file is "maintaining our own private fork of maven".
As far as forks go, it's a pretty mild one. It doesn't require us to compile maven from source, or anything scary like that.

But it's still a fork. And it's still annoying. I'm looking for something more like this:
https://stackoverflow.com/questions/67001968/how-to-disable-maven-blocking-external-http-repositores/68394404#68394404

(in fact, maybe that's exactly what I'm looking for.)
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
�This message is for information purposes only, it is not a recommendation, advice, offer or solicitation to buy or sell a product or service nor an official confirmation of any transaction. It is directed at persons who are professionals and is not intended for retail customer use. Intended for recipient only. This message is subject to the terms at: www.barclays.com/emaildisclaimer.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org

Re: request for documentation update about mirrors

Posted by Bernd Eckenfels <ec...@zusammenkunft.net>.

Well, it’s just a file to edit.


--
http://bernd.eckenfels.net
________________________________
Von: mark.yagnatinsky@barclays.com.INVALID <ma...@barclays.com.INVALID>
Gesendet: Thursday, December 9, 2021 6:22:46 AM
An: users@maven.apache.org <us...@maven.apache.org>
Betreff: RE: request for documentation update about mirrors

> But if you insist, I heared you can remove the blocked tag in your maven/conf settings.. ;)
But I can't, right?  I'd have edit the global settings file bundled with maven itself.
Or no?

_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
?This message is for information purposes only, it is not a recommendation, advice, offer or solicitation to buy or sell a product or service nor an official confirmation of any transaction. It is directed at persons who are professionals and is not intended for retail customer use. Intended for recipient only. This message is subject to the terms at: www.barclays.com/emaildisclaimer<http://www.barclays.com/emaildisclaimer>.

For important disclosures, please see: www.barclays.com/salesandtradingdisclaimer<http://www.barclays.com/salesandtradingdisclaimer> regarding market commentary from Barclays Sales and/or Trading, who are active market participants; https://www.investmentbank.barclays.com/disclosures/barclays-global-markets-disclosures.html regarding our standard terms for the Investment Bank of Barclays where we trade with you in principal-to-principal wholesale markets transactions; and in respect of Barclays Research, including disclosures relating to specific issuers, please see http://publicresearch.barclays.com.?
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
If you are incorporated or operating in Australia, please see https://www.home.barclays/disclosures/importantapacdisclosures.html for important disclosure.
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
How we use personal information  see our privacy notice https://www.investmentbank.barclays.com/disclosures/personalinformationuse.html
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org

RE: request for documentation update about mirrors

Posted by ma...@barclays.com.INVALID.

> But if you insist, I heared you can remove the blocked tag in your maven/conf settings.. ;) 
But I can't, right?  I'd have edit the global settings file bundled with maven itself.
Or no?

_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
�This message is for information purposes only, it is not a recommendation, advice, offer or solicitation to buy or sell a product or service nor an official confirmation of any transaction. It is directed at persons who are professionals and is not intended for retail customer use. Intended for recipient only. This message is subject to the terms at: www.barclays.com/emaildisclaimer.

For important disclosures, please see: www.barclays.com/salesandtradingdisclaimer regarding market commentary from Barclays Sales and/or Trading, who are active market participants; https://www.investmentbank.barclays.com/disclosures/barclays-global-markets-disclosures.html regarding our standard terms for the Investment Bank of Barclays where we trade with you in principal-to-principal wholesale markets transactions; and in respect of Barclays Research, including disclosures relating to specific issuers, please see http://publicresearch.barclays.com.�  
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
If you are incorporated or operating in Australia, please see https://www.home.barclays/disclosures/importantapacdisclosures.html for important disclosure.
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
How we use personal information  see our privacy notice https://www.investmentbank.barclays.com/disclosures/personalinformationuse.html 
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org

Re: request for documentation update about mirrors

Posted by Bernd Eckenfels <ec...@zusammenkunft.net>.

Hello,

I would define a single caching mirror repository (and maybe exclude all internal repositories which are already HTTPS). The mirror applies automatically to all repos, you don’t need to configure them individually.

And you should really really start on enabling HTTPS. It is imho no problem if some POM define a central with http, your settings.xml for that Repo-Id (and the mirror anyway) will have precedence.

But if you insist, I heared you can remove the blocked tag in your maven/conf settings.. ;) just be aware that most likely your compliance and network departments will love you for getting rid of a insecure intrusion vector in your supply chain.

Gruss
Bernd


--
http://bernd.eckenfels.net
________________________________
Von: mark.yagnatinsky@barclays.com.INVALID <ma...@barclays.com.INVALID>
Gesendet: Wednesday, December 8, 2021 4:07:31 PM
An: users@maven.apache.org <us...@maven.apache.org>
Betreff: request for documentation update about mirrors

I hope this is the right mailing list; if I not, would appreciate a redirect.
In the release notes for maven 3.8.1, here:
https://maven.apache.org/docs/3.8.1/release-notes.html
There is a helpfully titled section "How to fix when I get a HTTP repository blocked?"
https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked
It mentions 2 options:

*         Update to a newer version of the artifact you're fetching, which is presumably available over https

*         Define a mirror in your settings, which links to this page:
https://maven.apache.org/guides/mini/guide-mirror-settings.html

The first option is not helpful, since we are using a settings.xml which lists many http-only repositories, including one with an id of "central".
Since these are all on our internal network, the usual concerns about security don't apply, or at least not in full force like they would on the public internet.

(We don't let maven access the public internet.  If a fellow coworker is trying to hijack my maven downloads, I suppose they might succeed.  We'll keep taking that risk for now :))

That brings us to the second option: create a mirror.  Unfortunately, the linked page doesn't even mention anything about blocking and unblocking.
In fact, I can't find the <blocked> tag documented anywhere, though perhaps I'm looking in the wrong places.

What I'd ideally like to see is a way to "undo" the mirror defined in the global settings in one fell swoop.
That is, I do NOT want to go through the repos listed in our repositories, and then tediously create a mirror for each of them, one by one, and then remember to keep the two lists in sync if anything changes.

So: can the documentation be updated to mention anything about unblocking, and is there any way to do what I want?

Thanks,
Mark.

_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
?This message is for information purposes only, it is not a recommendation, advice, offer or solicitation to buy or sell a product or service nor an official confirmation of any transaction. It is directed at persons who are professionals and is not intended for retail customer use. Intended for recipient only. This message is subject to the terms at: www.barclays.com/emaildisclaimer<http://www.barclays.com/emaildisclaimer>.

For important disclosures, please see: www.barclays.com/salesandtradingdisclaimer<http://www.barclays.com/salesandtradingdisclaimer> regarding market commentary from Barclays Sales and/or Trading, who are active market participants; https://www.investmentbank.barclays.com/disclosures/barclays-global-markets-disclosures.html regarding our standard terms for the Investment Bank of Barclays where we trade with you in principal-to-principal wholesale markets transactions; and in respect of Barclays Research, including disclosures relating to specific issuers, please see http://publicresearch.barclays.com.?
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
If you are incorporated or operating in Australia, please see https://www.home.barclays/disclosures/importantapacdisclosures.html for important disclosure.
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________
How we use personal information  see our privacy notice https://www.investmentbank.barclays.com/disclosures/personalinformationuse.html
_________________________________________________________________________________________________________________________________________________________________________________________________________________________________