Package org.eclipse.aether.internal.impl

Class DefaultRemoteRepositoryManager

java.lang.Object
org.eclipse.aether.internal.impl.DefaultRemoteRepositoryManager
All Implemented Interfaces:
RemoteRepositoryManager
@Singleton @Named public class DefaultRemoteRepositoryManager extends Object implements RemoteRepositoryManager

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    CONFIG_PROP_AUTH_TO_DESCRIPTOR_REPOSITORIES
    Flag indicating whether session authentication (i.e.
    static final String
    CONFIG_PROP_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY
    Flag indicating whether the merge of a repository's release and snapshot policies (used when a single effective policy has to serve both natures, most notably for metadata of nature RELEASE_OR_SNAPSHOT such as maven-metadata.xml version lists) may pick the weaker of the two checksum policies, which was the legacy behavior.
    static final String
    CONFIG_PROP_RAW_CHECKSUM_POLICY_DOWNGRADE
    Flag indicating whether a repository declared by a remote artifact descriptor (POM) may weaken the checksum policy of the operator-defined mirror it is merged into.
    static final boolean
    DEFAULT_AUTH_TO_DESCRIPTOR_REPOSITORIES
     
    static final boolean
    DEFAULT_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY
     
    static final boolean
    DEFAULT_RAW_CHECKSUM_POLICY_DOWNGRADE
     

  • Constructor Summary

    Constructors
    Constructor
    Description
    DefaultRemoteRepositoryManager(UpdatePolicyAnalyzer updatePolicyAnalyzer, org.eclipse.aether.spi.connector.checksum.ChecksumPolicyProvider checksumPolicyProvider, org.eclipse.aether.spi.remoterepo.RepositoryKeyFunctionFactory repositoryKeyFunctionFactory)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    List<org.eclipse.aether.repository.RemoteRepository>
    aggregateRepositories(org.eclipse.aether.RepositorySystemSession session, List<org.eclipse.aether.repository.RemoteRepository> dominantRepositories, List<org.eclipse.aether.repository.RemoteRepository> recessiveRepositories, boolean recessiveIsRaw)
    Aggregates repository definitions by merging duplicate repositories and optionally applies mirror, proxy and authentication settings from the supplied session.
    List<org.eclipse.aether.repository.RemoteRepository>
    aggregateRepositories(org.eclipse.aether.RepositorySystemSession session, List<org.eclipse.aether.repository.RemoteRepository> dominantRepositories, List<org.eclipse.aether.repository.RemoteRepository> recessiveRepositories, boolean recessiveIsRaw, boolean recessiveIsFromDescriptor)
    Aggregates repository definitions by merging duplicate repositories and optionally applies mirror, proxy and authentication settings from the supplied session, additionally distinguishing the provenance of the recessive repository definitions.
    org.eclipse.aether.repository.RepositoryPolicy
    getPolicy(org.eclipse.aether.RepositorySystemSession session, org.eclipse.aether.repository.RemoteRepository repository, boolean releases, boolean snapshots)
    Gets the effective repository policy for the specified remote repository by merging the applicable snapshot/release policy of the repository with global settings from the supplied session.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • CONFIG_PROP_AUTH_TO_DESCRIPTOR_REPOSITORIES

      public static final String CONFIG_PROP_AUTH_TO_DESCRIPTOR_REPOSITORIES
      Flag indicating whether session authentication (i.e. credentials configured in settings.xml) may be applied, matched by plain repository ID, to repositories declared by remote artifact descriptors (POMs) that are merged into the effective repository list during dependency collection. When disabled (the default), session authentication is only applied to such a repository when an operator-defined mirror has been selected for it; if credentials would have matched a descriptor-declared repository, a warning naming the repository ID and URL is logged instead. Repositories supplied by the build itself (e.g. aggregated via RepositorySystem#newResolutionRepositories) are unaffected and keep receiving matching credentials. Enabling this restores the legacy behavior of applying matching session authentication to descriptor declared repositories regardless of their provenance.
      Since:
      2.0.23
      See Also:

    • DEFAULT_AUTH_TO_DESCRIPTOR_REPOSITORIES

      public static final boolean DEFAULT_AUTH_TO_DESCRIPTOR_REPOSITORIES
      See Also:

    • CONFIG_PROP_RAW_CHECKSUM_POLICY_DOWNGRADE

      public static final String CONFIG_PROP_RAW_CHECKSUM_POLICY_DOWNGRADE
      Flag indicating whether a repository declared by a remote artifact descriptor (POM) may weaken the checksum policy of the operator-defined mirror it is merged into. When disabled (the default), the effective checksum policy of a mirror never becomes weaker than what the mirror itself declares for the same nature: a recessive raw repository may still enable a nature or influence update policies, but a weaker checksum policy (e.g. <checksumPolicy>ignore</checksumPolicy> in a transitive POM) is not honored and a warning is logged instead. Enabling this restores the legacy weakest-wins merge, which let any POM in the dependency graph degrade or switch off checksum verification for downloads routed through the mirror.
      Since:
      2.0.23
      See Also:

    • DEFAULT_RAW_CHECKSUM_POLICY_DOWNGRADE

      public static final boolean DEFAULT_RAW_CHECKSUM_POLICY_DOWNGRADE
      See Also:

    • CONFIG_PROP_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY

      public static final String CONFIG_PROP_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY
      Flag indicating whether the merge of a repository's release and snapshot policies (used when a single effective policy has to serve both natures, most notably for metadata of nature RELEASE_OR_SNAPSHOT such as maven-metadata.xml version lists) may pick the weaker of the two checksum policies, which was the legacy behavior. When disabled (the default), the stronger of the two checksum policies wins, so enabling snapshots with a lenient checksum policy no longer silently downgrades checksum enforcement below what the operator configured for releases (or vice versa). An explicit checksum policy set on the session (e.g. via --strict-checksums) takes precedence over either behavior, as before.
      Since:
      2.0.23
      See Also:

    • DEFAULT_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY

      public static final boolean DEFAULT_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY
      See Also:

  • Constructor Details

    • DefaultRemoteRepositoryManager

      @Inject public DefaultRemoteRepositoryManager(UpdatePolicyAnalyzer updatePolicyAnalyzer, org.eclipse.aether.spi.connector.checksum.ChecksumPolicyProvider checksumPolicyProvider, org.eclipse.aether.spi.remoterepo.RepositoryKeyFunctionFactory repositoryKeyFunctionFactory)

  • Method Details

    • aggregateRepositories

      public List<org.eclipse.aether.repository.RemoteRepository> aggregateRepositories(org.eclipse.aether.RepositorySystemSession session, List<org.eclipse.aether.repository.RemoteRepository> dominantRepositories, List<org.eclipse.aether.repository.RemoteRepository> recessiveRepositories, boolean recessiveIsRaw)
      Description copied from interface: RemoteRepositoryManager
      Aggregates repository definitions by merging duplicate repositories and optionally applies mirror, proxy and authentication settings from the supplied session.
      Specified by:
      aggregateRepositories in interface RemoteRepositoryManager
      Parameters:
      session - The repository session during which the repositories will be accessed, must not be null.
      dominantRepositories - The current list of remote repositories to merge the new definitions into, must not be null.
      recessiveRepositories - The remote repositories to merge into the existing list, must not be null.
      recessiveIsRaw - true if the recessive repository definitions have not yet been subjected to mirror, proxy and authentication settings, false otherwise.
      Returns:
      The aggregated list of remote repositories, never null.
      See Also:
      • RepositorySystemSession.getMirrorSelector()
      • RepositorySystemSession.getProxySelector()
      • RepositorySystemSession.getAuthenticationSelector()

    • aggregateRepositories

      public List<org.eclipse.aether.repository.RemoteRepository> aggregateRepositories(org.eclipse.aether.RepositorySystemSession session, List<org.eclipse.aether.repository.RemoteRepository> dominantRepositories, List<org.eclipse.aether.repository.RemoteRepository> recessiveRepositories, boolean recessiveIsRaw, boolean recessiveIsFromDescriptor)
      Description copied from interface: RemoteRepositoryManager
      Aggregates repository definitions by merging duplicate repositories and optionally applies mirror, proxy and authentication settings from the supplied session, additionally distinguishing the provenance of the recessive repository definitions. Repository definitions that originate from a remote artifact descriptor (i.e. a POM downloaded during dependency collection) are remotely supplied input: implementations may withhold session authentication from them unless an operator-defined mirror has been selected for them, so that session authentication is applied only to repositories the operator configured. Repository definitions supplied by the build itself (e.g. via RepositorySystem#newResolutionRepositories) must keep receiving mirror, proxy and authentication settings as documented for RemoteRepositoryManager.aggregateRepositories(RepositorySystemSession, List, List, boolean).

      The default implementation ignores the provenance hint and delegates to RemoteRepositoryManager.aggregateRepositories(RepositorySystemSession, List, List, boolean).

      Specified by:
      aggregateRepositories in interface RemoteRepositoryManager
      Parameters:
      session - The repository session during which the repositories will be accessed, must not be null.
      dominantRepositories - The current list of remote repositories to merge the new definitions into, must not be null.
      recessiveRepositories - The remote repositories to merge into the existing list, must not be null.
      recessiveIsRaw - true if the recessive repository definitions have not yet been subjected to mirror, proxy and authentication settings, false otherwise.
      recessiveIsFromDescriptor - true if the recessive repository definitions were declared by a remote artifact descriptor (POM) rather than by the build itself, false otherwise.
      Returns:
      The aggregated list of remote repositories, never null.
      See Also:
      • RepositorySystemSession.getMirrorSelector()
      • RepositorySystemSession.getProxySelector()
      • RepositorySystemSession.getAuthenticationSelector()

    • getPolicy

      public org.eclipse.aether.repository.RepositoryPolicy getPolicy(org.eclipse.aether.RepositorySystemSession session, org.eclipse.aether.repository.RemoteRepository repository, boolean releases, boolean snapshots)
      Description copied from interface: RemoteRepositoryManager
      Gets the effective repository policy for the specified remote repository by merging the applicable snapshot/release policy of the repository with global settings from the supplied session.
      Specified by:
      getPolicy in interface RemoteRepositoryManager
      Parameters:
      session - The repository session during which the repository will be accessed, must not be null.
      repository - The remote repository to determine the effective policy for, must not be null.
      releases - true if the policy for release artifacts needs to be considered, false if not.
      snapshots - true if the policy for snapshot artifacts needs to be considered, false if not.
      Returns:
      The effective repository policy, never null.
      See Also:
      • RepositorySystemSession.getChecksumPolicy()
      • RepositorySystemSession.getUpdatePolicy()