Class AbstractDeployMojo

java.lang.Object

org.apache.maven.plugins.deploy.AbstractDeployMojo

All Implemented Interfaces:

org.apache.maven.api.plugin.Mojo

Direct Known Subclasses:

DeployFileMojo, DeployMojo

public abstract class AbstractDeployMojo
extends Object
implements org.apache.maven.api.plugin.Mojo

Abstract class for Deploy mojo's.

Field Summary

Fields

Modifier and Type	Field	Description
protected org.apache.maven.api.plugin.Log	logger
protected org.apache.maven.api.Session	session

Constructor Summary

Constructors

Constructor	Description
AbstractDeployMojo()

Method Summary

Modifier and Type	Method	Description
protected org.apache.maven.api.RemoteRepository	createDeploymentArtifactRepository(String id, String url)	Creates resolver RemoteRepository equipped with needed whistles and bells.
protected Collection<String>	getKnownRepositoryUrls(String id)	Collects the URLs this build already associates with the given repository id: mirror entries and profile repositories from settings.xml.
protected org.apache.maven.api.plugin.Log	getLog()
int	getRetryFailedDeploymentCount()
protected org.apache.maven.api.Session	getSession()
protected void	validateCredentialBinding(String id, String url)	Guards the repository id→URL credential binding: Maven resolves the credentials for a deployment repository purely by matching its id against a <server> entry in settings.xml, so any component that pairs a known server id with a new URL re-targets those credentials.
protected void	validateCredentialBinding(String id, String url, boolean fromUserProperty)	Guards the repository id→URL credential binding, weighing the provenance of the binding.
protected void	validateTransportSecurity(String id, String url)	Refuses cleartext deployment transports: with an http:// or ftp:// deployment URL, the HTTP Basic (or FTP) credentials resolved for id and all deployed artifacts would cross the network unencrypted.
protected void	warnIfAffectedPackagingAndMaven(String packaging)	If this plugin used in pre-3.9.0 Maven, the packaging maven-plugin will not deploy G level metadata.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.maven.api.plugin.Mojo

execute

Field Details

logger

@Inject
protected org.apache.maven.api.plugin.Log logger

session

@Inject
protected org.apache.maven.api.Session session

Constructor Details

AbstractDeployMojo

public AbstractDeployMojo()

Method Details

getRetryFailedDeploymentCount

public int getRetryFailedDeploymentCount()

warnIfAffectedPackagingAndMaven

protected void warnIfAffectedPackagingAndMaven(String packaging)

If this plugin used in pre-3.9.0 Maven, the packaging maven-plugin will not deploy G level metadata.

createDeploymentArtifactRepository

protected org.apache.maven.api.RemoteRepository createDeploymentArtifactRepository(String id,
 String url)

Creates resolver RemoteRepository equipped with needed whistles and bells.

validateTransportSecurity

protected void validateTransportSecurity(String id,
 String url)
                                  throws org.apache.maven.api.plugin.MojoException

Refuses cleartext deployment transports: with an http:// or ftp:// deployment URL, the HTTP Basic (or FTP) credentials resolved for id and all deployed artifacts would cross the network unencrypted. Loopback hosts are exempt (local mock/test repositories); everything else requires an explicit -D"maven.deploy.allowInsecureUrl"=true opt-out. Maven core's external:http:* mirror blocking covers dependency resolution only; this is the deployment-side counterpart.

Parameters:

id - the repository id (used in diagnostics)

url - the deployment URL

Throws:

org.apache.maven.api.plugin.MojoException - when the URL is cleartext, non-loopback, and not explicitly allowed

validateCredentialBinding

protected void validateCredentialBinding(String id,
 String url)
                                  throws org.apache.maven.api.plugin.MojoException

Guards the repository id→URL credential binding: Maven resolves the credentials for a deployment repository purely by matching its id against a <server> entry in settings.xml, so any component that pairs a known server id with a new URL re-targets those credentials. Equivalent to validateCredentialBinding(id, url, true): this overload is for values that are command-line-supplied by nature (deploy-file's repositoryId/url are plain -D parameters typed by the operator), so the no-URL-on-record case warns instead of refusing.

Parameters:

id - the repository id the deployment would bind credentials for

url - the URL the deployment would send those credentials to

Throws:

org.apache.maven.api.plugin.MojoException - when the binding re-targets known credentials to an unknown URL

validateCredentialBinding

protected void validateCredentialBinding(String id,
 String url,
 boolean fromUserProperty)
                                  throws org.apache.maven.api.plugin.MojoException

Guards the repository id→URL credential binding, weighing the provenance of the binding. When the given id matches a settings.xml server entry (so credentials are at stake), two cases are distinguished:

• URLs on record for the id (mirrors, profile repositories, and — for the deploy goal — the project's distributionManagement): the given URL must match one of them; otherwise the deployment is refused, naming both URLs — regardless of provenance.
• No URL on record for the id: the binding cannot be cross-checked, which is the mainline redirection shape (credentials stored for an id such as ossrh that settings.xml binds to no URL). A value the operator typed on the command line (fromUserProperty) proceeds with a WARN naming the URL the credentials will be sent to; a POM-sourced value (pom property or plugin configuration — attacker-writable in the malicious-POM model) is refused.

Every refusal can be overridden with -D"maven.deploy.allowCredentialReuse"=true (a user property: it cannot be set from a POM).

Parameters:

id - the repository id the deployment would bind credentials for

url - the URL the deployment would send those credentials to

fromUserProperty - whether the id/url pair was supplied on the command line (-D session user property) rather than from the POM or plugin configuration

Throws:

org.apache.maven.api.plugin.MojoException - when the binding re-targets known credentials to an unknown URL, or when a POM-sourced binding pairs stored credentials with a URL this build knows nothing about

getKnownRepositoryUrls

protected Collection<String> getKnownRepositoryUrls(String id)

Collects the URLs this build already associates with the given repository id: mirror entries and profile repositories from settings.xml. Subclasses add further sources (the deploy goal adds the project's distributionManagement).

Trust note: sources read from the project model (such as distributionManagement) are attacker-controlled in the malicious-POM model and are therefore advisory: they can only widen the accepted set for the mismatch check, never authorize a binding by their absence — the empty-record case is handled by provenance in validateCredentialBinding(String, String, boolean). Settings.xml-sourced entries (mirrors, profiles) are operator-controlled.

getSession

protected org.apache.maven.api.Session getSession()

getLog

protected org.apache.maven.api.plugin.Log getLog()