Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-23911

Some of JBoss EAP BOMs from nightly build still use maven repo url with plaintext http

    XMLWordPrintable

Details

    • False
    • None
    • False

    Description

      It seems that there are still plain-text HTTP URLs used for Maven repositories of some JBoss EAP BOMs we get from nightly, see:

      maven-repository/org/jboss/eap/wildfly-ejb-client-legacy-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-legacy-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/eap/wildfly-ejb-client-legacy-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-legacy-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/eap/wildfly-ejb-client-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/eap/wildfly-ejb-client-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/eap/wildfly-jaxws-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jaxws-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/eap/wildfly-jaxws-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jaxws-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/eap/wildfly-jms-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jms-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/eap/wildfly-jms-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jms-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8-with-tools/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-with-tools-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8-with-tools/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-with-tools-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-8.0.0.Beta-redhat-20220801.pom:      <url>http://repository.jboss.org/nexus/content/groups/public/</url>
maven-repository/org/jboss/eap/wildfly-ejb-client-legacy-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-legacy-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/eap/wildfly-ejb-client-legacy-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-legacy-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>
maven-repository/org/jboss/eap/wildfly-ejb-client-legacy-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-legacy-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/eap/wildfly-ejb-client-legacy-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-legacy-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>
maven-repository/org/jboss/eap/wildfly-ejb-client-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/eap/wildfly-ejb-client-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>
maven-repository/org/jboss/eap/wildfly-ejb-client-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/eap/wildfly-ejb-client-bom/8.0.0.Beta-redhat-20220801/wildfly-ejb-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>
maven-repository/org/jboss/eap/wildfly-jaxws-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jaxws-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/eap/wildfly-jaxws-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jaxws-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>
maven-repository/org/jboss/eap/wildfly-jaxws-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jaxws-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/eap/wildfly-jaxws-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jaxws-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>
maven-repository/org/jboss/eap/wildfly-jms-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jms-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/eap/wildfly-jms-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jms-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>
maven-repository/org/jboss/eap/wildfly-jms-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jms-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/eap/wildfly-jms-client-bom/8.0.0.Beta-redhat-20220801/wildfly-jms-client-bom-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8-with-tools/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-with-tools-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8-with-tools/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-with-tools-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8-with-tools/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-with-tools-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8-with-tools/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-with-tools-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/ga/</url>
maven-repository/org/jboss/bom/jboss-eap-jakartaee8/8.0.0.Beta-redhat-20220801/jboss-eap-jakartaee8-8.0.0.Beta-redhat-20220801.pom:      <url>http://maven.repository.redhat.com/earlyaccess/all/</url>

      We should probably tend to use HTTPS where possible. Also, since Apache Maven 3.8.1 it blocks HTTP by default (even though it can be workarounded).

      I looked into the upstream and there it seems okay. Also resulting generated boms from that repo seems to use HTTPS already and so are released ones. But productized BOMs are probably generated from some different codebase resulting in HTTP only use. Or is it some "performance" optimization that is present only in JBoss EAP nightly builds and will not be present in the official productized Beta/Final bits?

      I vote to have it via HTTPS only, unless there is some reasonable argument

      Attachments

        Issue Links

          is related to

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-22608 EAP 8.0 Maven repository contains poms with repository definitions

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • New

          Activity

            People

              dkreling Daniel Kreling
              jstourac@redhat.com Jan Stourac
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: