You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@maven.apache.org by Delany <de...@gmail.com> on 2021/08/14 07:25:47 UTC
3.8.2 transitive dependency insecure repo
The new org.apache.maven:maven-core:3.8.2 has a transitive dependency
org.jboss.weld:weld-parent:pom:6, but its source repository is
http://repository.jboss.org/maven2
When I run flatten-plugin with <flattenDependencyMode> set to "all", it
fails to resolve.
[ERROR] Failed to execute goal
org.codehaus.mojo:flatten-maven-plugin:1.2.7:flatten (default-cli) on
project dummy: failed to create a clean pom: unable to create flattened
dependencies: caught exception when flattening dependencies: Failed to read
artifact descriptor for javax.enterprise:cdi-api::1.0: Could not transfer
artifact org.jboss.weld:weld-parent:pom:6 from/to
maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for
repositories: [repository.jboss.org (http://repository.jboss.org/maven2,
default, releases), snapshots.jboss.org (http://snapshots.jboss.org/maven2,
default, snapshots), oss.sonatype.org/jboss-snapshots (
http://oss.sonatype.org/content/repositories/jboss-snapshots, default,
snapshots)] -> [Help 1]
Shouldn't the maven-core dependency tree at least not contradict itself?
Thanks,
Delany
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="
http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>tools</groupId>
<artifactId>dummy</artifactId>
<version>1.0.0</version>
<name>Dummy</name>
<dependencies>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-core</artifactId>
<version>3.8.2</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-model</artifactId>
<version>3.8.2</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>flatten-maven-plugin</artifactId>
<version>1.2.7</version>
<configuration>
<updatePomFile>true</updatePomFile>
<flattenMode>clean</flattenMode>
<flattenDependencyMode>all</flattenDependencyMode>
</configuration>
<executions>
<execution>
<id>flatten.clean</id>
<goals>
<goal>clean</goal>
</goals>
<phase>clean</phase>
</execution>
<execution>
<id>flatten</id>
<goals>
<goal>flatten</goal>
</goals>
<phase>initialize</phase>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
Re: 3.8.2 transitive dependency insecure repo
Posted by Michael Osipov <mi...@apache.org>.
Hi Stuart,
thanks for reaching out so fast.
Am 2021-08-18 um 14:51 schrieb Stuart McCulloch:
> The odd thing is that the pom blocked in the original
> message, org.jboss.weld:weld-parent:pom:6, is available on central:
>
>
> https://repo1.maven.org/maven2/org/jboss/weld/weld-parent/6/weld-parent-6.pom
>
> I haven't been able to find anything in that dependency chain that isn't
> also on central - but some of them do refer to remote repositories (which
> apparently is allowed, but is discouraged)
The reason is simple: repository order. Repos in POMs take precedence
before any other. See:
https://maven.apache.org/guides/mini/guide-multiple-repositories.html#repository-order
> Anyway I'm happy to change this dependency to a later version like 1.2 that
> has the remote repository in a separate profile.
I don't exactly know what happened in Susi space *after* 0.3.4, but I'd
be really greatful for a bump to CDI 1.2 which would ultimately resolve
the issue for us and all users.
Please also take a look at
https://bugs.eclipse.org/bugs/show_bug.cgi?id=539791 also. It is related
to CDI API.
Looking forward for 0.3.5. I'd like to push this update with Maven 3.8.3
this month.
BR,
Michael
> On Sat, 14 Aug 2021 at 20:36, Michael Osipov <mi...@apache.org> wrote:
>
>> Am 2021-08-14 um 21:25 schrieb Delany:
>>> Ok, sorry I didn't mention before you released, I wasn't sure of my
>> setup.
>>> https://issues.apache.org/jira/browse/MNG-7214
>>
>> Thanks, I just did a git log on the pom.xml and this issue existed for
>> at least five years in the codebase, no one ever noticed before the HTTP
>> blocker or being behind a firewall and working w/ a repo manager.
>>
>>> On Sat, 14 Aug 2021 at 20:56, Michael Osipov <mi...@apache.org>
>> wrote:
>>>
>>>> Thank you very, very much for this edge case.
>>>>
>>>> Gosh, I hate all of this JBoss conglomerate with a passion.
>>>>
>>>> This is our problem:
>>>>> [INFO] | +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
>>>>> [INFO] | | \- javax.enterprise:cdi-api:jar:1.0:compile
>>>>> [INFO] | | \- javax.annotation:jsr250-api:jar:1.0:compile
>>>>
>>>> Guess what, although javax.enterprise:cdi-api is in javax namespace its
>>>> parent is
>>>>> <parent>
>>>>> <groupId>org.jboss.weld</groupId>
>>>>> <artifactId>weld-api-parent</artifactId>
>>>>> <version>1.0</version>
>>>>> <relativePath>../parent/pom.xml</relativePath>
>>>>> </parent>
>>>>
>>>> WTF? How is this possible? Who signed this? The API should be completely
>>>> decoupled of Weld. The repo is burried in the parents. This is
>>>> absolutely unacceptable. It leaks now in the entire buildchain for
>>>> everyone who depends on our artifacts.
>>>>
>>>> We can do two things here:
>>>> 1. Exclude this transitive dependency and lose @Typed in Plexus to JSR
>>>> 330 migration
>>>> 2. Ask Stuart McCulloch to push a new Sisu release with updates to CDI
>>>> 1.2 which parents do not have a repo anymore.
>>>>
>>>> Still leaves a very bad after taste....
>>>>
>>>> Please file an issue, I will try talk to Stuart.
>>>>
>>>> I think this is ugly enough to justify 3.8.3 for all of those who
>>>> depends on our JARs. Plain Maven users aren't affected.
>>>>
>>>> Michael
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>>> For additional commands, e-mail: users-help@maven.apache.org
>>>>
>>>>
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>> For additional commands, e-mail: users-help@maven.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: 3.8.2 transitive dependency insecure repo
Posted by Stuart McCulloch <mc...@gmail.com>.
The odd thing is that the pom blocked in the original
message, org.jboss.weld:weld-parent:pom:6, is available on central:
https://repo1.maven.org/maven2/org/jboss/weld/weld-parent/6/weld-parent-6.pom
I haven't been able to find anything in that dependency chain that isn't
also on central - but some of them do refer to remote repositories (which
apparently is allowed, but is discouraged)
Anyway I'm happy to change this dependency to a later version like 1.2 that
has the remote repository in a separate profile.
On Sat, 14 Aug 2021 at 20:36, Michael Osipov <mi...@apache.org> wrote:
> Am 2021-08-14 um 21:25 schrieb Delany:
> > Ok, sorry I didn't mention before you released, I wasn't sure of my
> setup.
> > https://issues.apache.org/jira/browse/MNG-7214
>
> Thanks, I just did a git log on the pom.xml and this issue existed for
> at least five years in the codebase, no one ever noticed before the HTTP
> blocker or being behind a firewall and working w/ a repo manager.
>
> > On Sat, 14 Aug 2021 at 20:56, Michael Osipov <mi...@apache.org>
> wrote:
> >
> >> Thank you very, very much for this edge case.
> >>
> >> Gosh, I hate all of this JBoss conglomerate with a passion.
> >>
> >> This is our problem:
> >>> [INFO] | +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
> >>> [INFO] | | \- javax.enterprise:cdi-api:jar:1.0:compile
> >>> [INFO] | | \- javax.annotation:jsr250-api:jar:1.0:compile
> >>
> >> Guess what, although javax.enterprise:cdi-api is in javax namespace its
> >> parent is
> >>> <parent>
> >>> <groupId>org.jboss.weld</groupId>
> >>> <artifactId>weld-api-parent</artifactId>
> >>> <version>1.0</version>
> >>> <relativePath>../parent/pom.xml</relativePath>
> >>> </parent>
> >>
> >> WTF? How is this possible? Who signed this? The API should be completely
> >> decoupled of Weld. The repo is burried in the parents. This is
> >> absolutely unacceptable. It leaks now in the entire buildchain for
> >> everyone who depends on our artifacts.
> >>
> >> We can do two things here:
> >> 1. Exclude this transitive dependency and lose @Typed in Plexus to JSR
> >> 330 migration
> >> 2. Ask Stuart McCulloch to push a new Sisu release with updates to CDI
> >> 1.2 which parents do not have a repo anymore.
> >>
> >> Still leaves a very bad after taste....
> >>
> >> Please file an issue, I will try talk to Stuart.
> >>
> >> I think this is ugly enough to justify 3.8.3 for all of those who
> >> depends on our JARs. Plain Maven users aren't affected.
> >>
> >> Michael
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >> For additional commands, e-mail: users-help@maven.apache.org
> >>
> >>
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
Re: 3.8.2 transitive dependency insecure repo
Posted by Tamás Cservenák <ta...@cservenak.net>.
And @Typed exists in sisu as well, but to use it, you need to depend on it
(ideally don't)
T
On Sat, Aug 14, 2021, 21:36 Michael Osipov <mi...@apache.org> wrote:
> Am 2021-08-14 um 21:25 schrieb Delany:
> > Ok, sorry I didn't mention before you released, I wasn't sure of my
> setup.
> > https://issues.apache.org/jira/browse/MNG-7214
>
> Thanks, I just did a git log on the pom.xml and this issue existed for
> at least five years in the codebase, no one ever noticed before the HTTP
> blocker or being behind a firewall and working w/ a repo manager.
>
> > On Sat, 14 Aug 2021 at 20:56, Michael Osipov <mi...@apache.org>
> wrote:
> >
> >> Thank you very, very much for this edge case.
> >>
> >> Gosh, I hate all of this JBoss conglomerate with a passion.
> >>
> >> This is our problem:
> >>> [INFO] | +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
> >>> [INFO] | | \- javax.enterprise:cdi-api:jar:1.0:compile
> >>> [INFO] | | \- javax.annotation:jsr250-api:jar:1.0:compile
> >>
> >> Guess what, although javax.enterprise:cdi-api is in javax namespace its
> >> parent is
> >>> <parent>
> >>> <groupId>org.jboss.weld</groupId>
> >>> <artifactId>weld-api-parent</artifactId>
> >>> <version>1.0</version>
> >>> <relativePath>../parent/pom.xml</relativePath>
> >>> </parent>
> >>
> >> WTF? How is this possible? Who signed this? The API should be completely
> >> decoupled of Weld. The repo is burried in the parents. This is
> >> absolutely unacceptable. It leaks now in the entire buildchain for
> >> everyone who depends on our artifacts.
> >>
> >> We can do two things here:
> >> 1. Exclude this transitive dependency and lose @Typed in Plexus to JSR
> >> 330 migration
> >> 2. Ask Stuart McCulloch to push a new Sisu release with updates to CDI
> >> 1.2 which parents do not have a repo anymore.
> >>
> >> Still leaves a very bad after taste....
> >>
> >> Please file an issue, I will try talk to Stuart.
> >>
> >> I think this is ugly enough to justify 3.8.3 for all of those who
> >> depends on our JARs. Plain Maven users aren't affected.
> >>
> >> Michael
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >> For additional commands, e-mail: users-help@maven.apache.org
> >>
> >>
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
Re: 3.8.2 transitive dependency insecure repo
Posted by Michael Osipov <mi...@apache.org>.
Am 2021-08-14 um 21:25 schrieb Delany:
> Ok, sorry I didn't mention before you released, I wasn't sure of my setup.
> https://issues.apache.org/jira/browse/MNG-7214
Thanks, I just did a git log on the pom.xml and this issue existed for
at least five years in the codebase, no one ever noticed before the HTTP
blocker or being behind a firewall and working w/ a repo manager.
> On Sat, 14 Aug 2021 at 20:56, Michael Osipov <mi...@apache.org> wrote:
>
>> Thank you very, very much for this edge case.
>>
>> Gosh, I hate all of this JBoss conglomerate with a passion.
>>
>> This is our problem:
>>> [INFO] | +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
>>> [INFO] | | \- javax.enterprise:cdi-api:jar:1.0:compile
>>> [INFO] | | \- javax.annotation:jsr250-api:jar:1.0:compile
>>
>> Guess what, although javax.enterprise:cdi-api is in javax namespace its
>> parent is
>>> <parent>
>>> <groupId>org.jboss.weld</groupId>
>>> <artifactId>weld-api-parent</artifactId>
>>> <version>1.0</version>
>>> <relativePath>../parent/pom.xml</relativePath>
>>> </parent>
>>
>> WTF? How is this possible? Who signed this? The API should be completely
>> decoupled of Weld. The repo is burried in the parents. This is
>> absolutely unacceptable. It leaks now in the entire buildchain for
>> everyone who depends on our artifacts.
>>
>> We can do two things here:
>> 1. Exclude this transitive dependency and lose @Typed in Plexus to JSR
>> 330 migration
>> 2. Ask Stuart McCulloch to push a new Sisu release with updates to CDI
>> 1.2 which parents do not have a repo anymore.
>>
>> Still leaves a very bad after taste....
>>
>> Please file an issue, I will try talk to Stuart.
>>
>> I think this is ugly enough to justify 3.8.3 for all of those who
>> depends on our JARs. Plain Maven users aren't affected.
>>
>> Michael
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>> For additional commands, e-mail: users-help@maven.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: 3.8.2 transitive dependency insecure repo
Posted by Delany <de...@gmail.com>.
Ok, sorry I didn't mention before you released, I wasn't sure of my setup.
https://issues.apache.org/jira/browse/MNG-7214
Delany
On Sat, 14 Aug 2021 at 20:56, Michael Osipov <mi...@apache.org> wrote:
> Thank you very, very much for this edge case.
>
> Gosh, I hate all of this JBoss conglomerate with a passion.
>
> This is our problem:
> > [INFO] | +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
> > [INFO] | | \- javax.enterprise:cdi-api:jar:1.0:compile
> > [INFO] | | \- javax.annotation:jsr250-api:jar:1.0:compile
>
> Guess what, although javax.enterprise:cdi-api is in javax namespace its
> parent is
> > <parent>
> > <groupId>org.jboss.weld</groupId>
> > <artifactId>weld-api-parent</artifactId>
> > <version>1.0</version>
> > <relativePath>../parent/pom.xml</relativePath>
> > </parent>
>
> WTF? How is this possible? Who signed this? The API should be completely
> decoupled of Weld. The repo is burried in the parents. This is
> absolutely unacceptable. It leaks now in the entire buildchain for
> everyone who depends on our artifacts.
>
> We can do two things here:
> 1. Exclude this transitive dependency and lose @Typed in Plexus to JSR
> 330 migration
> 2. Ask Stuart McCulloch to push a new Sisu release with updates to CDI
> 1.2 which parents do not have a repo anymore.
>
> Still leaves a very bad after taste....
>
> Please file an issue, I will try talk to Stuart.
>
> I think this is ugly enough to justify 3.8.3 for all of those who
> depends on our JARs. Plain Maven users aren't affected.
>
> Michael
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
Re: 3.8.2 transitive dependency insecure repo
Posted by Michael Osipov <mi...@apache.org>.
Thank you very, very much for this edge case.
Gosh, I hate all of this JBoss conglomerate with a passion.
This is our problem:
> [INFO] | +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
> [INFO] | | \- javax.enterprise:cdi-api:jar:1.0:compile
> [INFO] | | \- javax.annotation:jsr250-api:jar:1.0:compile
Guess what, although javax.enterprise:cdi-api is in javax namespace its
parent is
> <parent>
> <groupId>org.jboss.weld</groupId>
> <artifactId>weld-api-parent</artifactId>
> <version>1.0</version>
> <relativePath>../parent/pom.xml</relativePath>
> </parent>
WTF? How is this possible? Who signed this? The API should be completely
decoupled of Weld. The repo is burried in the parents. This is
absolutely unacceptable. It leaks now in the entire buildchain for
everyone who depends on our artifacts.
We can do two things here:
1. Exclude this transitive dependency and lose @Typed in Plexus to JSR
330 migration
2. Ask Stuart McCulloch to push a new Sisu release with updates to CDI
1.2 which parents do not have a repo anymore.
Still leaves a very bad after taste....
Please file an issue, I will try talk to Stuart.
I think this is ugly enough to justify 3.8.3 for all of those who
depends on our JARs. Plain Maven users aren't affected.
Michael
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: 3.8.2 transitive dependency insecure repo
Posted by Michael Osipov <mi...@apache.org>.
My bad, will take a look.
Am 2021-08-14 um 16:57 schrieb Delany:
> The pom.xml is in my original mail. See
> https://lists.apache.org/thread.html/rda29028b2c8985f3b94e721d3014a948b312fbddf95ffaa4971acc03%40%3Cusers.maven.apache.org%3E
>
> Then
> ```
> mvn -N io.takari:maven:wrapper -Dmaven=3.8.2
> ./mvnw initialize
> ```
>
> And then
>
> [ERROR] Failed to execute goal
> org.codehaus.mojo:flatten-maven-plugin:1.2.7:flatten (flatten) on project
> dummy: failed to create a clean pom: unable to create flattened
> dependencies: caught exception when flattening dependencies: Failed to read
> artifact descriptor for javax.enterprise:cdi-api::1.0: Could not transfer
> artifact org.jboss.weld:weld-parent:pom:6 from/to
> maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for
> repositories: [repository.jboss.org (http://repository.jboss.org/maven2,
> default, releases), snapshots.jboss.org (http://snapshots.jboss.org/maven2,
> default, snapshots), oss.sonatype.org/jboss-snapshots (
> http://oss.sonatype.org/content/repositories/jboss-snapshots, default,
> snapshots)] -> [Help 1]
>
> For my purposes I don't need the flatten plugin resolving
> parents/transitive dependencies so I changed <flattenDependencyMode> from
> all to direct. But maybe someone else would?
> Delany
>
> On Sat, 14 Aug 2021 at 16:41, Michael Osipov <mi...@apache.org> wrote:
>
>> This doesn't add up. It runs on your project, not Maven Core.
>> Provide a sample project to reproduce.
>>
>> Am 2021-08-14 um 14:06 schrieb Delany:
>>> Hi Michael,
>>> Do this `./mvnw dependency:list-repositories`
>>> I see
>>>
>>> [INFO] --- maven-dependency-plugin:2.8:list-repositories
>> (default-cli) @
>>> dummy ---
>>> [INFO] Repositories Used by this build:
>>> [INFO] id: central
>>> url: https://repo.maven.apache.org/maven2
>>> layout: default
>>> snapshots: [enabled => false, update => daily]
>>> releases: [enabled => true, update => daily]
>>> blocked: false
>>>
>>> [INFO] id: maven-default-http-blocker
>>> url: http://0.0.0.0/
>>> layout: default
>>> snapshots: [enabled => false, update => daily]
>>> releases: [enabled => true, update => daily]
>>> blocked: true
>>>
>>> dependency:tree doesn't show parents, but dependency:list and
>>> dependency:resolve do if you ask: `./mvnw dependency:list
>>> -DincludeParents=true | grep jboss`.
>>>
>>> If I delete ~/.m2/repository/org/jboss and do
>>> `./mvnw dependency:resolve -DincludeParents=true`
>>> it resolves the parent from central
>>>
>>> Downloading from central:
>>>
>> https://repo.maven.apache.org/maven2/org/jboss/weld/weld-parent/6/weld-parent-6.pom
>>>
>>> Thanks,
>>> Delany
>>>
>>>
>>> On Sat, 14 Aug 2021 at 10:30, Michael Osipov <mi...@apache.org>
>> wrote:
>>>
>>>> Am 2021-08-14 um 09:25 schrieb Delany:
>>>>> The new org.apache.maven:maven-core:3.8.2 has a transitive dependency
>>>>> org.jboss.weld:weld-parent:pom:6, but its source repository is
>>>>> http://repository.jboss.org/maven2
>>>>>
>>>>> When I run flatten-plugin with <flattenDependencyMode> set to "all", it
>>>>> fails to resolve.
>>>>>
>>>>> [ERROR] Failed to execute goal
>>>>> org.codehaus.mojo:flatten-maven-plugin:1.2.7:flatten (default-cli) on
>>>>> project dummy: failed to create a clean pom: unable to create flattened
>>>>> dependencies: caught exception when flattening dependencies: Failed to
>>>> read
>>>>> artifact descriptor for javax.enterprise:cdi-api::1.0: Could not
>> transfer
>>>>> artifact org.jboss.weld:weld-parent:pom:6 from/to
>>>>> maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for
>>>>> repositories: [repository.jboss.org (
>> http://repository.jboss.org/maven2,
>>>>> default, releases), snapshots.jboss.org (
>>>> http://snapshots.jboss.org/maven2,
>>>>> default, snapshots), oss.sonatype.org/jboss-snapshots (
>>>>> http://oss.sonatype.org/content/repositories/jboss-snapshots, default,
>>>>> snapshots)] -> [Help 1]
>>>>>
>>>>> Shouldn't the maven-core dependency tree at least not contradict
>> itself?
>>>>
>>>> Call me stupid, I don't see it:
>>>>> [INFO] --- maven-dependency-plugin:3.1.1:tree (default-cli) @
>> maven-core
>>>> ---
>>>>> [INFO] org.apache.maven:maven-core:jar:3.8.3-SNAPSHOT
>>>>> [INFO] +- org.apache.maven:maven-model:jar:3.8.3-SNAPSHOT:compile
>>>>> [INFO] +- org.apache.maven:maven-settings:jar:3.8.3-SNAPSHOT:compile
>>>>> [INFO] +-
>>>> org.apache.maven:maven-settings-builder:jar:3.8.3-SNAPSHOT:compile
>>>>> [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
>>>>> [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
>>>>> [INFO] +-
>>>> org.apache.maven:maven-builder-support:jar:3.8.3-SNAPSHOT:compile
>>>>> [INFO] +-
>>>> org.apache.maven:maven-repository-metadata:jar:3.8.3-SNAPSHOT:compile
>>>>> [INFO] +- org.apache.maven:maven-artifact:jar:3.8.3-SNAPSHOT:compile
>>>>> [INFO] +- org.apache.maven:maven-plugin-api:jar:3.8.3-SNAPSHOT:compile
>>>>> [INFO] +-
>> org.apache.maven:maven-model-builder:jar:3.8.3-SNAPSHOT:compile
>>>>> [INFO] +-
>>>> org.apache.maven:maven-resolver-provider:jar:3.8.3-SNAPSHOT:compile
>>>>> [INFO] | \- org.slf4j:slf4j-api:jar:1.7.32:compile
>>>>> [INFO] +-
>> org.apache.maven.resolver:maven-resolver-impl:jar:1.6.3:compile
>>>>> [INFO] +-
>> org.apache.maven.resolver:maven-resolver-api:jar:1.6.3:compile
>>>>> [INFO] +-
>> org.apache.maven.resolver:maven-resolver-spi:jar:1.6.3:compile
>>>>> [INFO] +-
>> org.apache.maven.resolver:maven-resolver-util:jar:1.6.3:compile
>>>>> [INFO] +- org.apache.maven.shared:maven-shared-utils:jar:3.3.4:compile
>>>>> [INFO] | \- commons-io:commons-io:jar:2.6:compile
>>>>> [INFO] +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
>>>>> [INFO] | \- javax.enterprise:cdi-api:jar:1.0:compile
>>>>> [INFO] | \- javax.annotation:jsr250-api:jar:1.0:compile
>>>>> [INFO] +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.3.4:compile
>>>>> [INFO] +- com.google.inject:guice:jar:no_aop:4.2.2:compile
>>>>> [INFO] | +- aopalliance:aopalliance:jar:1.0:compile
>>>>> [INFO] | \- com.google.guava:guava:jar:25.1-android:compile
>>>>> [INFO] | +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
>>>>> [INFO] | +-
>>>> org.checkerframework:checker-compat-qual:jar:2.0.0:compile
>>>>> [INFO] | +-
>>>> com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
>>>>> [INFO] | +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
>>>>> [INFO] | \-
>>>> org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
>>>>> [INFO] +- javax.inject:javax.inject:jar:1:compile
>>>>> [INFO] +- org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
>>>>> [INFO] +- org.codehaus.plexus:plexus-classworlds:jar:2.6.0:compile
>>>>> [INFO] +-
>>>> org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
>>>>> [INFO] +- org.codehaus.plexus:plexus-cipher:jar:1.8:test
>>>>> [INFO] +- org.apache.commons:commons-lang3:jar:3.8.1:compile
>>>>> [INFO] +- commons-jxpath:commons-jxpath:jar:1.3:test
>>>>> [INFO] +- org.mockito:mockito-core:jar:2.21.0:test
>>>>> [INFO] | +- net.bytebuddy:byte-buddy:jar:1.8.15:test
>>>>> [INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.8.15:test
>>>>> [INFO] | \- org.objenesis:objenesis:jar:2.6:test
>>>>> [INFO] +- org.hamcrest:hamcrest-library:jar:1.3:test
>>>>> [INFO] | \- org.hamcrest:hamcrest-core:jar:1.3:test
>>>>> [INFO] \- junit:junit:jar:4.12:test
>>>>
>>>>
>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>>> For additional commands, e-mail: users-help@maven.apache.org
>>>>
>>>>
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>> For additional commands, e-mail: users-help@maven.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: 3.8.2 transitive dependency insecure repo
Posted by Delany <de...@gmail.com>.
The pom.xml is in my original mail. See
https://lists.apache.org/thread.html/rda29028b2c8985f3b94e721d3014a948b312fbddf95ffaa4971acc03%40%3Cusers.maven.apache.org%3E
Then
```
mvn -N io.takari:maven:wrapper -Dmaven=3.8.2
./mvnw initialize
```
And then
[ERROR] Failed to execute goal
org.codehaus.mojo:flatten-maven-plugin:1.2.7:flatten (flatten) on project
dummy: failed to create a clean pom: unable to create flattened
dependencies: caught exception when flattening dependencies: Failed to read
artifact descriptor for javax.enterprise:cdi-api::1.0: Could not transfer
artifact org.jboss.weld:weld-parent:pom:6 from/to
maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for
repositories: [repository.jboss.org (http://repository.jboss.org/maven2,
default, releases), snapshots.jboss.org (http://snapshots.jboss.org/maven2,
default, snapshots), oss.sonatype.org/jboss-snapshots (
http://oss.sonatype.org/content/repositories/jboss-snapshots, default,
snapshots)] -> [Help 1]
For my purposes I don't need the flatten plugin resolving
parents/transitive dependencies so I changed <flattenDependencyMode> from
all to direct. But maybe someone else would?
Delany
On Sat, 14 Aug 2021 at 16:41, Michael Osipov <mi...@apache.org> wrote:
> This doesn't add up. It runs on your project, not Maven Core.
> Provide a sample project to reproduce.
>
> Am 2021-08-14 um 14:06 schrieb Delany:
> > Hi Michael,
> > Do this `./mvnw dependency:list-repositories`
> > I see
> >
> > [INFO] --- maven-dependency-plugin:2.8:list-repositories
> (default-cli) @
> > dummy ---
> > [INFO] Repositories Used by this build:
> > [INFO] id: central
> > url: https://repo.maven.apache.org/maven2
> > layout: default
> > snapshots: [enabled => false, update => daily]
> > releases: [enabled => true, update => daily]
> > blocked: false
> >
> > [INFO] id: maven-default-http-blocker
> > url: http://0.0.0.0/
> > layout: default
> > snapshots: [enabled => false, update => daily]
> > releases: [enabled => true, update => daily]
> > blocked: true
> >
> > dependency:tree doesn't show parents, but dependency:list and
> > dependency:resolve do if you ask: `./mvnw dependency:list
> > -DincludeParents=true | grep jboss`.
> >
> > If I delete ~/.m2/repository/org/jboss and do
> > `./mvnw dependency:resolve -DincludeParents=true`
> > it resolves the parent from central
> >
> > Downloading from central:
> >
> https://repo.maven.apache.org/maven2/org/jboss/weld/weld-parent/6/weld-parent-6.pom
> >
> > Thanks,
> > Delany
> >
> >
> > On Sat, 14 Aug 2021 at 10:30, Michael Osipov <mi...@apache.org>
> wrote:
> >
> >> Am 2021-08-14 um 09:25 schrieb Delany:
> >>> The new org.apache.maven:maven-core:3.8.2 has a transitive dependency
> >>> org.jboss.weld:weld-parent:pom:6, but its source repository is
> >>> http://repository.jboss.org/maven2
> >>>
> >>> When I run flatten-plugin with <flattenDependencyMode> set to "all", it
> >>> fails to resolve.
> >>>
> >>> [ERROR] Failed to execute goal
> >>> org.codehaus.mojo:flatten-maven-plugin:1.2.7:flatten (default-cli) on
> >>> project dummy: failed to create a clean pom: unable to create flattened
> >>> dependencies: caught exception when flattening dependencies: Failed to
> >> read
> >>> artifact descriptor for javax.enterprise:cdi-api::1.0: Could not
> transfer
> >>> artifact org.jboss.weld:weld-parent:pom:6 from/to
> >>> maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for
> >>> repositories: [repository.jboss.org (
> http://repository.jboss.org/maven2,
> >>> default, releases), snapshots.jboss.org (
> >> http://snapshots.jboss.org/maven2,
> >>> default, snapshots), oss.sonatype.org/jboss-snapshots (
> >>> http://oss.sonatype.org/content/repositories/jboss-snapshots, default,
> >>> snapshots)] -> [Help 1]
> >>>
> >>> Shouldn't the maven-core dependency tree at least not contradict
> itself?
> >>
> >> Call me stupid, I don't see it:
> >>> [INFO] --- maven-dependency-plugin:3.1.1:tree (default-cli) @
> maven-core
> >> ---
> >>> [INFO] org.apache.maven:maven-core:jar:3.8.3-SNAPSHOT
> >>> [INFO] +- org.apache.maven:maven-model:jar:3.8.3-SNAPSHOT:compile
> >>> [INFO] +- org.apache.maven:maven-settings:jar:3.8.3-SNAPSHOT:compile
> >>> [INFO] +-
> >> org.apache.maven:maven-settings-builder:jar:3.8.3-SNAPSHOT:compile
> >>> [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> >>> [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> >>> [INFO] +-
> >> org.apache.maven:maven-builder-support:jar:3.8.3-SNAPSHOT:compile
> >>> [INFO] +-
> >> org.apache.maven:maven-repository-metadata:jar:3.8.3-SNAPSHOT:compile
> >>> [INFO] +- org.apache.maven:maven-artifact:jar:3.8.3-SNAPSHOT:compile
> >>> [INFO] +- org.apache.maven:maven-plugin-api:jar:3.8.3-SNAPSHOT:compile
> >>> [INFO] +-
> org.apache.maven:maven-model-builder:jar:3.8.3-SNAPSHOT:compile
> >>> [INFO] +-
> >> org.apache.maven:maven-resolver-provider:jar:3.8.3-SNAPSHOT:compile
> >>> [INFO] | \- org.slf4j:slf4j-api:jar:1.7.32:compile
> >>> [INFO] +-
> org.apache.maven.resolver:maven-resolver-impl:jar:1.6.3:compile
> >>> [INFO] +-
> org.apache.maven.resolver:maven-resolver-api:jar:1.6.3:compile
> >>> [INFO] +-
> org.apache.maven.resolver:maven-resolver-spi:jar:1.6.3:compile
> >>> [INFO] +-
> org.apache.maven.resolver:maven-resolver-util:jar:1.6.3:compile
> >>> [INFO] +- org.apache.maven.shared:maven-shared-utils:jar:3.3.4:compile
> >>> [INFO] | \- commons-io:commons-io:jar:2.6:compile
> >>> [INFO] +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
> >>> [INFO] | \- javax.enterprise:cdi-api:jar:1.0:compile
> >>> [INFO] | \- javax.annotation:jsr250-api:jar:1.0:compile
> >>> [INFO] +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.3.4:compile
> >>> [INFO] +- com.google.inject:guice:jar:no_aop:4.2.2:compile
> >>> [INFO] | +- aopalliance:aopalliance:jar:1.0:compile
> >>> [INFO] | \- com.google.guava:guava:jar:25.1-android:compile
> >>> [INFO] | +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
> >>> [INFO] | +-
> >> org.checkerframework:checker-compat-qual:jar:2.0.0:compile
> >>> [INFO] | +-
> >> com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
> >>> [INFO] | +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
> >>> [INFO] | \-
> >> org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
> >>> [INFO] +- javax.inject:javax.inject:jar:1:compile
> >>> [INFO] +- org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
> >>> [INFO] +- org.codehaus.plexus:plexus-classworlds:jar:2.6.0:compile
> >>> [INFO] +-
> >> org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
> >>> [INFO] +- org.codehaus.plexus:plexus-cipher:jar:1.8:test
> >>> [INFO] +- org.apache.commons:commons-lang3:jar:3.8.1:compile
> >>> [INFO] +- commons-jxpath:commons-jxpath:jar:1.3:test
> >>> [INFO] +- org.mockito:mockito-core:jar:2.21.0:test
> >>> [INFO] | +- net.bytebuddy:byte-buddy:jar:1.8.15:test
> >>> [INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.8.15:test
> >>> [INFO] | \- org.objenesis:objenesis:jar:2.6:test
> >>> [INFO] +- org.hamcrest:hamcrest-library:jar:1.3:test
> >>> [INFO] | \- org.hamcrest:hamcrest-core:jar:1.3:test
> >>> [INFO] \- junit:junit:jar:4.12:test
> >>
> >>
> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >> For additional commands, e-mail: users-help@maven.apache.org
> >>
> >>
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
Re: 3.8.2 transitive dependency insecure repo
Posted by Michael Osipov <mi...@apache.org>.
This doesn't add up. It runs on your project, not Maven Core.
Provide a sample project to reproduce.
Am 2021-08-14 um 14:06 schrieb Delany:
> Hi Michael,
> Do this `./mvnw dependency:list-repositories`
> I see
>
> [INFO] --- maven-dependency-plugin:2.8:list-repositories (default-cli) @
> dummy ---
> [INFO] Repositories Used by this build:
> [INFO] id: central
> url: https://repo.maven.apache.org/maven2
> layout: default
> snapshots: [enabled => false, update => daily]
> releases: [enabled => true, update => daily]
> blocked: false
>
> [INFO] id: maven-default-http-blocker
> url: http://0.0.0.0/
> layout: default
> snapshots: [enabled => false, update => daily]
> releases: [enabled => true, update => daily]
> blocked: true
>
> dependency:tree doesn't show parents, but dependency:list and
> dependency:resolve do if you ask: `./mvnw dependency:list
> -DincludeParents=true | grep jboss`.
>
> If I delete ~/.m2/repository/org/jboss and do
> `./mvnw dependency:resolve -DincludeParents=true`
> it resolves the parent from central
>
> Downloading from central:
> https://repo.maven.apache.org/maven2/org/jboss/weld/weld-parent/6/weld-parent-6.pom
>
> Thanks,
> Delany
>
>
> On Sat, 14 Aug 2021 at 10:30, Michael Osipov <mi...@apache.org> wrote:
>
>> Am 2021-08-14 um 09:25 schrieb Delany:
>>> The new org.apache.maven:maven-core:3.8.2 has a transitive dependency
>>> org.jboss.weld:weld-parent:pom:6, but its source repository is
>>> http://repository.jboss.org/maven2
>>>
>>> When I run flatten-plugin with <flattenDependencyMode> set to "all", it
>>> fails to resolve.
>>>
>>> [ERROR] Failed to execute goal
>>> org.codehaus.mojo:flatten-maven-plugin:1.2.7:flatten (default-cli) on
>>> project dummy: failed to create a clean pom: unable to create flattened
>>> dependencies: caught exception when flattening dependencies: Failed to
>> read
>>> artifact descriptor for javax.enterprise:cdi-api::1.0: Could not transfer
>>> artifact org.jboss.weld:weld-parent:pom:6 from/to
>>> maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for
>>> repositories: [repository.jboss.org (http://repository.jboss.org/maven2,
>>> default, releases), snapshots.jboss.org (
>> http://snapshots.jboss.org/maven2,
>>> default, snapshots), oss.sonatype.org/jboss-snapshots (
>>> http://oss.sonatype.org/content/repositories/jboss-snapshots, default,
>>> snapshots)] -> [Help 1]
>>>
>>> Shouldn't the maven-core dependency tree at least not contradict itself?
>>
>> Call me stupid, I don't see it:
>>> [INFO] --- maven-dependency-plugin:3.1.1:tree (default-cli) @ maven-core
>> ---
>>> [INFO] org.apache.maven:maven-core:jar:3.8.3-SNAPSHOT
>>> [INFO] +- org.apache.maven:maven-model:jar:3.8.3-SNAPSHOT:compile
>>> [INFO] +- org.apache.maven:maven-settings:jar:3.8.3-SNAPSHOT:compile
>>> [INFO] +-
>> org.apache.maven:maven-settings-builder:jar:3.8.3-SNAPSHOT:compile
>>> [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
>>> [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
>>> [INFO] +-
>> org.apache.maven:maven-builder-support:jar:3.8.3-SNAPSHOT:compile
>>> [INFO] +-
>> org.apache.maven:maven-repository-metadata:jar:3.8.3-SNAPSHOT:compile
>>> [INFO] +- org.apache.maven:maven-artifact:jar:3.8.3-SNAPSHOT:compile
>>> [INFO] +- org.apache.maven:maven-plugin-api:jar:3.8.3-SNAPSHOT:compile
>>> [INFO] +- org.apache.maven:maven-model-builder:jar:3.8.3-SNAPSHOT:compile
>>> [INFO] +-
>> org.apache.maven:maven-resolver-provider:jar:3.8.3-SNAPSHOT:compile
>>> [INFO] | \- org.slf4j:slf4j-api:jar:1.7.32:compile
>>> [INFO] +- org.apache.maven.resolver:maven-resolver-impl:jar:1.6.3:compile
>>> [INFO] +- org.apache.maven.resolver:maven-resolver-api:jar:1.6.3:compile
>>> [INFO] +- org.apache.maven.resolver:maven-resolver-spi:jar:1.6.3:compile
>>> [INFO] +- org.apache.maven.resolver:maven-resolver-util:jar:1.6.3:compile
>>> [INFO] +- org.apache.maven.shared:maven-shared-utils:jar:3.3.4:compile
>>> [INFO] | \- commons-io:commons-io:jar:2.6:compile
>>> [INFO] +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
>>> [INFO] | \- javax.enterprise:cdi-api:jar:1.0:compile
>>> [INFO] | \- javax.annotation:jsr250-api:jar:1.0:compile
>>> [INFO] +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.3.4:compile
>>> [INFO] +- com.google.inject:guice:jar:no_aop:4.2.2:compile
>>> [INFO] | +- aopalliance:aopalliance:jar:1.0:compile
>>> [INFO] | \- com.google.guava:guava:jar:25.1-android:compile
>>> [INFO] | +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
>>> [INFO] | +-
>> org.checkerframework:checker-compat-qual:jar:2.0.0:compile
>>> [INFO] | +-
>> com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
>>> [INFO] | +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
>>> [INFO] | \-
>> org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
>>> [INFO] +- javax.inject:javax.inject:jar:1:compile
>>> [INFO] +- org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
>>> [INFO] +- org.codehaus.plexus:plexus-classworlds:jar:2.6.0:compile
>>> [INFO] +-
>> org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
>>> [INFO] +- org.codehaus.plexus:plexus-cipher:jar:1.8:test
>>> [INFO] +- org.apache.commons:commons-lang3:jar:3.8.1:compile
>>> [INFO] +- commons-jxpath:commons-jxpath:jar:1.3:test
>>> [INFO] +- org.mockito:mockito-core:jar:2.21.0:test
>>> [INFO] | +- net.bytebuddy:byte-buddy:jar:1.8.15:test
>>> [INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.8.15:test
>>> [INFO] | \- org.objenesis:objenesis:jar:2.6:test
>>> [INFO] +- org.hamcrest:hamcrest-library:jar:1.3:test
>>> [INFO] | \- org.hamcrest:hamcrest-core:jar:1.3:test
>>> [INFO] \- junit:junit:jar:4.12:test
>>
>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>> For additional commands, e-mail: users-help@maven.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: 3.8.2 transitive dependency insecure repo
Posted by Delany <de...@gmail.com>.
Hi Michael,
Do this `./mvnw dependency:list-repositories`
I see
[INFO] --- maven-dependency-plugin:2.8:list-repositories (default-cli) @
dummy ---
[INFO] Repositories Used by this build:
[INFO] id: central
url: https://repo.maven.apache.org/maven2
layout: default
snapshots: [enabled => false, update => daily]
releases: [enabled => true, update => daily]
blocked: false
[INFO] id: maven-default-http-blocker
url: http://0.0.0.0/
layout: default
snapshots: [enabled => false, update => daily]
releases: [enabled => true, update => daily]
blocked: true
dependency:tree doesn't show parents, but dependency:list and
dependency:resolve do if you ask: `./mvnw dependency:list
-DincludeParents=true | grep jboss`.
If I delete ~/.m2/repository/org/jboss and do
`./mvnw dependency:resolve -DincludeParents=true`
it resolves the parent from central
Downloading from central:
https://repo.maven.apache.org/maven2/org/jboss/weld/weld-parent/6/weld-parent-6.pom
Thanks,
Delany
On Sat, 14 Aug 2021 at 10:30, Michael Osipov <mi...@apache.org> wrote:
> Am 2021-08-14 um 09:25 schrieb Delany:
> > The new org.apache.maven:maven-core:3.8.2 has a transitive dependency
> > org.jboss.weld:weld-parent:pom:6, but its source repository is
> > http://repository.jboss.org/maven2
> >
> > When I run flatten-plugin with <flattenDependencyMode> set to "all", it
> > fails to resolve.
> >
> > [ERROR] Failed to execute goal
> > org.codehaus.mojo:flatten-maven-plugin:1.2.7:flatten (default-cli) on
> > project dummy: failed to create a clean pom: unable to create flattened
> > dependencies: caught exception when flattening dependencies: Failed to
> read
> > artifact descriptor for javax.enterprise:cdi-api::1.0: Could not transfer
> > artifact org.jboss.weld:weld-parent:pom:6 from/to
> > maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for
> > repositories: [repository.jboss.org (http://repository.jboss.org/maven2,
> > default, releases), snapshots.jboss.org (
> http://snapshots.jboss.org/maven2,
> > default, snapshots), oss.sonatype.org/jboss-snapshots (
> > http://oss.sonatype.org/content/repositories/jboss-snapshots, default,
> > snapshots)] -> [Help 1]
> >
> > Shouldn't the maven-core dependency tree at least not contradict itself?
>
> Call me stupid, I don't see it:
> > [INFO] --- maven-dependency-plugin:3.1.1:tree (default-cli) @ maven-core
> ---
> > [INFO] org.apache.maven:maven-core:jar:3.8.3-SNAPSHOT
> > [INFO] +- org.apache.maven:maven-model:jar:3.8.3-SNAPSHOT:compile
> > [INFO] +- org.apache.maven:maven-settings:jar:3.8.3-SNAPSHOT:compile
> > [INFO] +-
> org.apache.maven:maven-settings-builder:jar:3.8.3-SNAPSHOT:compile
> > [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> > [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> > [INFO] +-
> org.apache.maven:maven-builder-support:jar:3.8.3-SNAPSHOT:compile
> > [INFO] +-
> org.apache.maven:maven-repository-metadata:jar:3.8.3-SNAPSHOT:compile
> > [INFO] +- org.apache.maven:maven-artifact:jar:3.8.3-SNAPSHOT:compile
> > [INFO] +- org.apache.maven:maven-plugin-api:jar:3.8.3-SNAPSHOT:compile
> > [INFO] +- org.apache.maven:maven-model-builder:jar:3.8.3-SNAPSHOT:compile
> > [INFO] +-
> org.apache.maven:maven-resolver-provider:jar:3.8.3-SNAPSHOT:compile
> > [INFO] | \- org.slf4j:slf4j-api:jar:1.7.32:compile
> > [INFO] +- org.apache.maven.resolver:maven-resolver-impl:jar:1.6.3:compile
> > [INFO] +- org.apache.maven.resolver:maven-resolver-api:jar:1.6.3:compile
> > [INFO] +- org.apache.maven.resolver:maven-resolver-spi:jar:1.6.3:compile
> > [INFO] +- org.apache.maven.resolver:maven-resolver-util:jar:1.6.3:compile
> > [INFO] +- org.apache.maven.shared:maven-shared-utils:jar:3.3.4:compile
> > [INFO] | \- commons-io:commons-io:jar:2.6:compile
> > [INFO] +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
> > [INFO] | \- javax.enterprise:cdi-api:jar:1.0:compile
> > [INFO] | \- javax.annotation:jsr250-api:jar:1.0:compile
> > [INFO] +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.3.4:compile
> > [INFO] +- com.google.inject:guice:jar:no_aop:4.2.2:compile
> > [INFO] | +- aopalliance:aopalliance:jar:1.0:compile
> > [INFO] | \- com.google.guava:guava:jar:25.1-android:compile
> > [INFO] | +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
> > [INFO] | +-
> org.checkerframework:checker-compat-qual:jar:2.0.0:compile
> > [INFO] | +-
> com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
> > [INFO] | +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
> > [INFO] | \-
> org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
> > [INFO] +- javax.inject:javax.inject:jar:1:compile
> > [INFO] +- org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
> > [INFO] +- org.codehaus.plexus:plexus-classworlds:jar:2.6.0:compile
> > [INFO] +-
> org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
> > [INFO] +- org.codehaus.plexus:plexus-cipher:jar:1.8:test
> > [INFO] +- org.apache.commons:commons-lang3:jar:3.8.1:compile
> > [INFO] +- commons-jxpath:commons-jxpath:jar:1.3:test
> > [INFO] +- org.mockito:mockito-core:jar:2.21.0:test
> > [INFO] | +- net.bytebuddy:byte-buddy:jar:1.8.15:test
> > [INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.8.15:test
> > [INFO] | \- org.objenesis:objenesis:jar:2.6:test
> > [INFO] +- org.hamcrest:hamcrest-library:jar:1.3:test
> > [INFO] | \- org.hamcrest:hamcrest-core:jar:1.3:test
> > [INFO] \- junit:junit:jar:4.12:test
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
Re: 3.8.2 transitive dependency insecure repo
Posted by Michael Osipov <mi...@apache.org>.
Am 2021-08-14 um 09:25 schrieb Delany:
> The new org.apache.maven:maven-core:3.8.2 has a transitive dependency
> org.jboss.weld:weld-parent:pom:6, but its source repository is
> http://repository.jboss.org/maven2
>
> When I run flatten-plugin with <flattenDependencyMode> set to "all", it
> fails to resolve.
>
> [ERROR] Failed to execute goal
> org.codehaus.mojo:flatten-maven-plugin:1.2.7:flatten (default-cli) on
> project dummy: failed to create a clean pom: unable to create flattened
> dependencies: caught exception when flattening dependencies: Failed to read
> artifact descriptor for javax.enterprise:cdi-api::1.0: Could not transfer
> artifact org.jboss.weld:weld-parent:pom:6 from/to
> maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for
> repositories: [repository.jboss.org (http://repository.jboss.org/maven2,
> default, releases), snapshots.jboss.org (http://snapshots.jboss.org/maven2,
> default, snapshots), oss.sonatype.org/jboss-snapshots (
> http://oss.sonatype.org/content/repositories/jboss-snapshots, default,
> snapshots)] -> [Help 1]
>
> Shouldn't the maven-core dependency tree at least not contradict itself?
Call me stupid, I don't see it:
> [INFO] --- maven-dependency-plugin:3.1.1:tree (default-cli) @ maven-core ---
> [INFO] org.apache.maven:maven-core:jar:3.8.3-SNAPSHOT
> [INFO] +- org.apache.maven:maven-model:jar:3.8.3-SNAPSHOT:compile
> [INFO] +- org.apache.maven:maven-settings:jar:3.8.3-SNAPSHOT:compile
> [INFO] +- org.apache.maven:maven-settings-builder:jar:3.8.3-SNAPSHOT:compile
> [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> [INFO] +- org.apache.maven:maven-builder-support:jar:3.8.3-SNAPSHOT:compile
> [INFO] +- org.apache.maven:maven-repository-metadata:jar:3.8.3-SNAPSHOT:compile
> [INFO] +- org.apache.maven:maven-artifact:jar:3.8.3-SNAPSHOT:compile
> [INFO] +- org.apache.maven:maven-plugin-api:jar:3.8.3-SNAPSHOT:compile
> [INFO] +- org.apache.maven:maven-model-builder:jar:3.8.3-SNAPSHOT:compile
> [INFO] +- org.apache.maven:maven-resolver-provider:jar:3.8.3-SNAPSHOT:compile
> [INFO] | \- org.slf4j:slf4j-api:jar:1.7.32:compile
> [INFO] +- org.apache.maven.resolver:maven-resolver-impl:jar:1.6.3:compile
> [INFO] +- org.apache.maven.resolver:maven-resolver-api:jar:1.6.3:compile
> [INFO] +- org.apache.maven.resolver:maven-resolver-spi:jar:1.6.3:compile
> [INFO] +- org.apache.maven.resolver:maven-resolver-util:jar:1.6.3:compile
> [INFO] +- org.apache.maven.shared:maven-shared-utils:jar:3.3.4:compile
> [INFO] | \- commons-io:commons-io:jar:2.6:compile
> [INFO] +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.4:compile
> [INFO] | \- javax.enterprise:cdi-api:jar:1.0:compile
> [INFO] | \- javax.annotation:jsr250-api:jar:1.0:compile
> [INFO] +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.3.4:compile
> [INFO] +- com.google.inject:guice:jar:no_aop:4.2.2:compile
> [INFO] | +- aopalliance:aopalliance:jar:1.0:compile
> [INFO] | \- com.google.guava:guava:jar:25.1-android:compile
> [INFO] | +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
> [INFO] | +- org.checkerframework:checker-compat-qual:jar:2.0.0:compile
> [INFO] | +- com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
> [INFO] | +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
> [INFO] | \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
> [INFO] +- javax.inject:javax.inject:jar:1:compile
> [INFO] +- org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
> [INFO] +- org.codehaus.plexus:plexus-classworlds:jar:2.6.0:compile
> [INFO] +- org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
> [INFO] +- org.codehaus.plexus:plexus-cipher:jar:1.8:test
> [INFO] +- org.apache.commons:commons-lang3:jar:3.8.1:compile
> [INFO] +- commons-jxpath:commons-jxpath:jar:1.3:test
> [INFO] +- org.mockito:mockito-core:jar:2.21.0:test
> [INFO] | +- net.bytebuddy:byte-buddy:jar:1.8.15:test
> [INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.8.15:test
> [INFO] | \- org.objenesis:objenesis:jar:2.6:test
> [INFO] +- org.hamcrest:hamcrest-library:jar:1.3:test
> [INFO] | \- org.hamcrest:hamcrest-core:jar:1.3:test
> [INFO] \- junit:junit:jar:4.12:test
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org