bug#35462: maven ignoring mirror-settings in ~/.m2/settings.xml

bug#35462: maven ignoring mirror-settings in ~/.m2/settings.xml

[Arne Babenhauserheide]

[-- Attachment #1: Type: text/plain, Size: 1069 bytes --]

Hi,

When I set a mirror in ~/.m2/settings.xml, that mirror is not used by
the maven in Guix.

To reproduce:

    mkdir -p ~/.m2/
    echo '
    <settings>
      <servers>
        <server>
          <id>internal</id>
          <username>foo</username>
          <password>bar</password>
        </server>
      </servers>
      <mirrors>
        <mirror>
          <id>nexus</id>
          <name>nexus</name>
          <url>http://nexus.example.com/nexus/content/groups/public/</url>
          <mirrorOf>*</mirrorOf>
        </mirror>
      </mirrors>
    </settings>
    ' > ~/.m2/settings.xml
    # run maven somewhere

With this setting, maven should run every request through the configured
nexus (which in this case means that any try to download should fail).

In my setup, maven just ignores this setting and keeps downloading from
repo.maven.apache.org which (a) could leak internal information and (b)
does not get our internal packages.

Best wishes,
Arne
-- 
Unpolitisch sein
heißt politisch sein
ohne es zu merken

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 1076 bytes --]

bug#35462: maven ignoring mirror-settings in ~/.m2/settings.xml

[Julien Lepiller]

Le Sat, 27 Apr 2019 22:53:37 +0200,
Arne Babenhauserheide <arne_bab@web.de> a écrit :

> Hi,
> 
> When I set a mirror in ~/.m2/settings.xml, that mirror is not used by
> the maven in Guix.
> 
> To reproduce:
> 
>     mkdir -p ~/.m2/
>     echo '
>     <settings>
>       <servers>
>         <server>
>           <id>internal</id>
>           <username>foo</username>
>           <password>bar</password>
>         </server>
>       </servers>
>       <mirrors>
>         <mirror>
>           <id>nexus</id>
>           <name>nexus</name>
>           <url>http://nexus.example.com/nexus/content/groups/public/</url>
>           <mirrorOf>*</mirrorOf>
>         </mirror>
>       </mirrors>
>     </settings>
>     ' > ~/.m2/settings.xml
>     # run maven somewhere
> 
> With this setting, maven should run every request through the
> configured nexus (which in this case means that any try to download
> should fail).
> 
> In my setup, maven just ignores this setting and keeps downloading
> from repo.maven.apache.org which (a) could leak internal information
> and (b) does not get our internal packages.
> 
> Best wishes,
> Arne

Hi,

I've given a look at this bug and it seems that our maven package
totally ignores settings, even if given on the CLI:

mvn help:effective-settings --debug -s ~/.m2/settings.xml
-gs ~/.m2/settings.xml

has no effect...

strace -f mvn ... doesn't show any reference to a settings.xml either
(not even the globabl one in the store...).

bug#35462: maven ignoring mirror-settings in ~/.m2/settings.xml

[Arne Babenhauserheide]

[-- Attachment #1: Type: text/plain, Size: 767 bytes --]

Hi Julien,

Julien Lepiller <julien@lepiller.eu> writes:
>> In my setup, maven just ignores this setting and keeps downloading
>> from repo.maven.apache.org which (a) could leak internal information
>> and (b) does not get our internal packages.
> I've given a look at this bug and it seems that our maven package
> totally ignores settings, even if given on the CLI:
>
> mvn help:effective-settings --debug -s ~/.m2/settings.xml
> -gs ~/.m2/settings.xml
>
> has no effect...
>
> strace -f mvn ... doesn't show any reference to a settings.xml either
> (not even the globabl one in the store...).

Thank you for checking! Do you have an idea how we can fix that?

Best wishes,
Arne
-- 
Unpolitisch sein
heißt politisch sein
ohne es zu merken

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 1076 bytes --]

bug#35462: maven ignoring mirror-settings in ~/.m2/settings.xml

[Julien Lepiller]

Le 30 avril 2019 22:15:25 GMT+02:00, Arne Babenhauserheide <arne_bab@web.de> a écrit :
>Hi Julien,
>
>Julien Lepiller <julien@lepiller.eu> writes:
>>> In my setup, maven just ignores this setting and keeps downloading
>>> from repo.maven.apache.org which (a) could leak internal information
>>> and (b) does not get our internal packages.
>> I've given a look at this bug and it seems that our maven package
>> totally ignores settings, even if given on the CLI:
>>
>> mvn help:effective-settings --debug -s ~/.m2/settings.xml
>> -gs ~/.m2/settings.xml
>>
>> has no effect...
>>
>> strace -f mvn ... doesn't show any reference to a settings.xml either
>> (not even the globabl one in the store...).
>
>Thank you for checking! Do you have an idea how we can fix that?
>
>Best wishes,
>Arne

I hade no idea :/

Maybe there's something wrong wuth our maven-settings or something maven expects is not there which leads it to not load config?