[JIRA] (JPAR-197) Remove our repositories from POMs

Mon Sep 5 15:12:55 UTC 2022

Tom Zeller ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A0fa99aa9-d698-454c-a274-7a41bee6cef5 ) *commented* on JPAR-197 ( https://shibboleth.atlassian.net/browse/JPAR-197?atlOrigin=eyJpIjoiZmQ5NjQ2NWZhYWNjNGQ3MjkxYjVjYTFkNDhlYjA4NTEiLCJwIjoiaiJ9 )

Re: Remove our repositories from POMs ( https://shibboleth.atlassian.net/browse/JPAR-197?atlOrigin=eyJpIjoiZmQ5NjQ2NWZhYWNjNGQ3MjkxYjVjYTFkNDhlYjA4NTEiLCJwIjoiaiJ9 )

Picking this back up again ...

Actually I think we should keep repositories in POMs but remove them at release.

Deployed release artifacts will have no repositories in POMs, which is the Maven "best practice" [1], and could be enforced using a built-in [2] Maven Enforcer rule.

Yes, one more detail to remember at release time.

Reason being expediency, e.g. the Spring Framework milestone repository.

Alternatives include :

* declare repositories in settings.xml
* host third-party milestone/snapshots via Nexus/Apache
* proxy using Nexus

While declaring repositories in settings.xml has been our plan, it's a little more work to make changes on the CI nodes. Rather than declaring third-party snapshot/milestone repositories (e.g. Spring, Jetty, ldaptive) individually in settings.xml, I'd probably rather host them via a third-party repository in Nexus. At the moment, we would need to cut AMIs to change settings.xml, but we could automate using a script or git repository etc and restart agents when we make changes.

Maven 5 might introduce the notion of build and consumer POMs, so this (remove repos from non-snapshot POMs during deployment) would fit that pattern. [3]

The whole point is that release artifacts should only depend on Central (because sans-signature-cheching it's trivial to introduce supply/dependency-chain attacks since transitive/plugin/test dependencies inject their repositories into the runtime artifact resolution chain AIUI).

[1] https://central.sonatype.org/publish/requirements/#a-complete-example-pom ( https://central.sonatype.org/publish/requirements/#a-complete-example-pom )

"we discourage the usage of <repositories> and <pluginRepositories> and instead publish any required components to the Central Repository. This applies for your own components as well as for 3rd party artifacts."

[2] https://maven.apache.org/enforcer/enforcer-rules/requireNoRepositories.html ( https://maven.apache.org/enforcer/enforcer-rules/requireNoRepositories.html )
mvn enforcer:enforce -Drules=requireNoRepositories

[3] https://www.javaadvent.com/2021/12/from-maven-3-to-maven-5.html ( https://www.javaadvent.com/2021/12/from-maven-3-to-maven-5.html )

https://maven.apache.org/guides/mini/guide-multiple-repositories.html ( https://maven.apache.org/guides/mini/guide-multiple-repositories.html )

Repository Order

Remote repository URLs are queried in the following order for artifacts until one returns a valid result:

effective settings:
   Global settings.xml
   User settings.xml
local effective build POM:
   Local pom.xml
   Parent POMs, recursively
   Super POM
effective POMs from dependency path to the artifact.

For each of these locations, the repositories within the profiles are queried first in the order outlined at Introduction to build profiles.

Before downloading from a repository, mirrors configuration is applied.

Effective settings and local build POM, with profile taken into account, can easily be reviewed to see their repositories order with mvn help:effective-settings and mvn help:effective-pom -Dverbose.

( https://shibboleth.atlassian.net/browse/JPAR-197#add-comment?atlOrigin=eyJpIjoiZmQ5NjQ2NWZhYWNjNGQ3MjkxYjVjYTFkNDhlYjA4NTEiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JPAR-197#add-comment?atlOrigin=eyJpIjoiZmQ5NjQ2NWZhYWNjNGQ3MjkxYjVjYTFkNDhlYjA4NTEiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100206- sha1:3fcec87 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220905/0a3f62a3/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-c40cfbbd-2379-449e-8233-ebb5d5c24466
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220905/0a3f62a3/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-9691b525-516b-471b-824f-c0763877fdca
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220905/0a3f62a3/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-1279216f-6594-44c6-bc9d-161de24ef1ab
Type: image/png
Size: 468 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220905/0a3f62a3/attachment-0005.png>