Skip to content

Fix master#110

Open
wheelerlaw wants to merge 1 commit into
ExpediaGroup:masterfrom
cvp-ops:http-to-https
Open

Fix master#110
wheelerlaw wants to merge 1 commit into
ExpediaGroup:masterfrom
cvp-ops:http-to-https

Conversation

@wheelerlaw
Copy link
Copy Markdown
Contributor

@wheelerlaw wheelerlaw commented Oct 28, 2021

Summary

Maven now disables http repos by default. See more information in this StackOverflow question:

Maven now disables all insecure http://* mirrors by default. Here is explanation from maven mainteners: http://maven.apache.org/docs/3.8.1/release-notes.html#cve-2021-26291

More and more repositories use HTTPS nowadays, but this hasn’t always been the case. This means that Maven Central contains POMs with custom repositories that refer to a URL over HTTP. This makes downloads via such repository a target for a MITM attack. At the same time, developers are probably not aware that for some downloads an insecure URL is being used. Because uploaded POMs to Maven Central are immutable, a change for Maven was required. To solve this, we extended the mirror configuration with parameter, and we added a new external:http:* mirror selector (like existing external:*), meaning “any external URL using HTTP”. The decision was made to block such external HTTP repositories by default: this is done by providing a mirror in the conf/settings.xml blocking insecure HTTP external URLs.

This changes the Jenkins repo from http to https.

Checklist

Testing

(Remove this checklist and replace it with "N/A - no code changes" if this PR does not modify source code)

  • I have manually verified that my code changes do the right thing.
  • I have run the tests and verified that my changes do not introduce any regressions.
  • I have written unit tests to verify that my code changes do the right thing and to protect my code against regressions

Documentation

(Remove this checklist and replace it with "N/A - no code changes" if this PR does not modify source code)

  • I have updated the "Unreleased" section of CHANGELOG.md with a brief description of my changes.
  • I have updated code comments - both GroovyDoc/JavaDoc-style comments and inline comments - where appropriate.
  • I have read CONTRIBUTING.md and have followed its guidance.

Comment thread pom.xml
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants