Package org.eclipse.aether.internal.impl

Class DefaultRemoteRepositoryManager

java.lang.Object

org.eclipse.aether.internal.impl.DefaultRemoteRepositoryManager

All Implemented Interfaces:

RemoteRepositoryManager

@Singleton
@Named
public class DefaultRemoteRepositoryManager
extends Object
implements RemoteRepositoryManager

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CONFIG_PROP_AUTH_TO_DESCRIPTOR_REPOSITORIES	Flag indicating whether session authentication (i.e.
static final String	CONFIG_PROP_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY	Flag indicating whether the merge of a repository's release and snapshot policies (used when a single effective policy has to serve both natures, most notably for metadata of nature RELEASE_OR_SNAPSHOT such as maven-metadata.xml version lists) may pick the weaker of the two checksum policies, which was the legacy behavior.
static final String	CONFIG_PROP_RAW_CHECKSUM_POLICY_DOWNGRADE	Flag indicating whether a repository declared by a remote artifact descriptor (POM) may weaken the checksum policy of the operator-defined mirror it is merged into.
static final boolean	DEFAULT_AUTH_TO_DESCRIPTOR_REPOSITORIES
static final boolean	DEFAULT_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY
static final boolean	DEFAULT_RAW_CHECKSUM_POLICY_DOWNGRADE

Constructor Summary

Constructors

Constructor	Description
DefaultRemoteRepositoryManager(UpdatePolicyAnalyzer updatePolicyAnalyzer, ChecksumPolicyProvider checksumPolicyProvider, RepositoryKeyFunctionFactory repositoryKeyFunctionFactory)

Method Summary

Modifier and Type	Method	Description
List<RemoteRepository>	aggregateRepositories(RepositorySystemSession session, List<RemoteRepository> dominantRepositories, List<RemoteRepository> recessiveRepositories, boolean recessiveIsRaw)	Aggregates repository definitions by merging duplicate repositories and optionally applies mirror, proxy and authentication settings from the supplied session.
List<RemoteRepository>	aggregateRepositories(RepositorySystemSession session, List<RemoteRepository> dominantRepositories, List<RemoteRepository> recessiveRepositories, boolean recessiveIsRaw, boolean recessiveIsFromDescriptor)	Aggregates repository definitions by merging duplicate repositories and optionally applies mirror, proxy and authentication settings from the supplied session, additionally distinguishing the provenance of the recessive repository definitions.
RepositoryPolicy	getPolicy(RepositorySystemSession session, RemoteRepository repository, boolean releases, boolean snapshots)	Gets the effective repository policy for the specified remote repository by merging the applicable snapshot/release policy of the repository with global settings from the supplied session.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

CONFIG_PROP_AUTH_TO_DESCRIPTOR_REPOSITORIES

public static final String CONFIG_PROP_AUTH_TO_DESCRIPTOR_REPOSITORIES

Flag indicating whether session authentication (i.e. credentials configured in settings.xml) may be applied, matched by plain repository ID, to repositories declared by remote artifact descriptors (POMs) that are merged into the effective repository list during dependency collection. When disabled (the default), session authentication is only applied to such a repository when an operator-defined mirror has been selected for it; if credentials would have matched a descriptor-declared repository, a warning naming the repository ID and URL is logged instead. Repositories supplied by the build itself (e.g. aggregated via RepositorySystem#newResolutionRepositories) are unaffected and keep receiving matching credentials. Enabling this restores the legacy behavior of applying matching session authentication to descriptor declared repositories regardless of their provenance.

Since:

2.0.23

See Also:

• Constant Field Values

Sourced from:

RepositorySystemSession.getConfigProperties()

Value type:

Boolean

Default value:

DEFAULT_AUTH_TO_DESCRIPTOR_REPOSITORIES

DEFAULT_AUTH_TO_DESCRIPTOR_REPOSITORIES

public static final boolean DEFAULT_AUTH_TO_DESCRIPTOR_REPOSITORIES

See Also:

• Constant Field Values

CONFIG_PROP_RAW_CHECKSUM_POLICY_DOWNGRADE

public static final String CONFIG_PROP_RAW_CHECKSUM_POLICY_DOWNGRADE

Flag indicating whether a repository declared by a remote artifact descriptor (POM) may weaken the checksum policy of the operator-defined mirror it is merged into. When disabled (the default), the effective checksum policy of a mirror never becomes weaker than what the mirror itself declares for the same nature: a recessive raw repository may still enable a nature or influence update policies, but a weaker checksum policy (e.g. <checksumPolicy>ignore</checksumPolicy> in a transitive POM) is not honored and a warning is logged instead. Enabling this restores the legacy weakest-wins merge, which let any POM in the dependency graph degrade or switch off checksum verification for downloads routed through the mirror.

Since:

2.0.23

See Also:

• Constant Field Values

Sourced from:

RepositorySystemSession.getConfigProperties()

Value type:

Boolean

Default value:

DEFAULT_RAW_CHECKSUM_POLICY_DOWNGRADE

DEFAULT_RAW_CHECKSUM_POLICY_DOWNGRADE

public static final boolean DEFAULT_RAW_CHECKSUM_POLICY_DOWNGRADE

See Also:

• Constant Field Values

CONFIG_PROP_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY

public static final String CONFIG_PROP_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY

Flag indicating whether the merge of a repository's release and snapshot policies (used when a single effective policy has to serve both natures, most notably for metadata of nature RELEASE_OR_SNAPSHOT such as maven-metadata.xml version lists) may pick the weaker of the two checksum policies, which was the legacy behavior. When disabled (the default), the stronger of the two checksum policies wins, so enabling snapshots with a lenient checksum policy no longer silently downgrades checksum enforcement below what the operator configured for releases (or vice versa). An explicit checksum policy set on the session (e.g. via --strict-checksums) takes precedence over either behavior, as before.

Since:

2.0.23

See Also:

• Constant Field Values

Sourced from:

RepositorySystemSession.getConfigProperties()

Value type:

Boolean

Default value:

DEFAULT_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY

DEFAULT_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY

public static final boolean DEFAULT_NATURE_MERGE_WEAKEST_CHECKSUM_POLICY

See Also:

• Constant Field Values

Constructor Details

DefaultRemoteRepositoryManager

@Inject
public DefaultRemoteRepositoryManager(UpdatePolicyAnalyzer updatePolicyAnalyzer,
 ChecksumPolicyProvider checksumPolicyProvider,
 RepositoryKeyFunctionFactory repositoryKeyFunctionFactory)

Method Details

aggregateRepositories

public List<RemoteRepository> aggregateRepositories(RepositorySystemSession session,
 List<RemoteRepository> dominantRepositories,
 List<RemoteRepository> recessiveRepositories,
 boolean recessiveIsRaw)

Description copied from interface: RemoteRepositoryManager

Aggregates repository definitions by merging duplicate repositories and optionally applies mirror, proxy and authentication settings from the supplied session.

Specified by:

aggregateRepositories in interface RemoteRepositoryManager

Parameters:

session - The repository session during which the repositories will be accessed, must not be null.

dominantRepositories - The current list of remote repositories to merge the new definitions into, must not be null.

recessiveRepositories - The remote repositories to merge into the existing list, must not be null.

recessiveIsRaw - true if the recessive repository definitions have not yet been subjected to mirror, proxy and authentication settings, false otherwise.

Returns:

The aggregated list of remote repositories, never null.

See Also:

• RepositorySystemSession.getMirrorSelector()
• RepositorySystemSession.getProxySelector()
• RepositorySystemSession.getAuthenticationSelector()

aggregateRepositories

public List<RemoteRepository> aggregateRepositories(RepositorySystemSession session,
 List<RemoteRepository> dominantRepositories,
 List<RemoteRepository> recessiveRepositories,
 boolean recessiveIsRaw,
 boolean recessiveIsFromDescriptor)

Description copied from interface: RemoteRepositoryManager

Aggregates repository definitions by merging duplicate repositories and optionally applies mirror, proxy and authentication settings from the supplied session, additionally distinguishing the provenance of the recessive repository definitions. Repository definitions that originate from a remote artifact descriptor (i.e. a POM downloaded during dependency collection) are remotely supplied input: implementations may withhold session authentication from them unless an operator-defined mirror has been selected for them, so that session authentication is applied only to repositories the operator configured. Repository definitions supplied by the build itself (e.g. via RepositorySystem#newResolutionRepositories) must keep receiving mirror, proxy and authentication settings as documented for RemoteRepositoryManager.aggregateRepositories(RepositorySystemSession, List, List, boolean).

The default implementation ignores the provenance hint and delegates to RemoteRepositoryManager.aggregateRepositories(RepositorySystemSession, List, List, boolean).

Specified by:

aggregateRepositories in interface RemoteRepositoryManager

Parameters:

session - The repository session during which the repositories will be accessed, must not be null.

dominantRepositories - The current list of remote repositories to merge the new definitions into, must not be null.

recessiveRepositories - The remote repositories to merge into the existing list, must not be null.

recessiveIsRaw - true if the recessive repository definitions have not yet been subjected to mirror, proxy and authentication settings, false otherwise.

recessiveIsFromDescriptor - true if the recessive repository definitions were declared by a remote artifact descriptor (POM) rather than by the build itself, false otherwise.

Returns:

The aggregated list of remote repositories, never null.

See Also:

• RepositorySystemSession.getMirrorSelector()
• RepositorySystemSession.getProxySelector()
• RepositorySystemSession.getAuthenticationSelector()

getPolicy

public RepositoryPolicy getPolicy(RepositorySystemSession session,
 RemoteRepository repository,
 boolean releases,
 boolean snapshots)

Description copied from interface: RemoteRepositoryManager

Gets the effective repository policy for the specified remote repository by merging the applicable snapshot/release policy of the repository with global settings from the supplied session.

Specified by:

getPolicy in interface RemoteRepositoryManager

Parameters:

session - The repository session during which the repository will be accessed, must not be null.

repository - The remote repository to determine the effective policy for, must not be null.

releases - true if the policy for release artifacts needs to be considered, false if not.

snapshots - true if the policy for snapshot artifacts needs to be considered, false if not.

Returns:

The effective repository policy, never null.

See Also:

• RepositorySystemSession.getChecksumPolicy()
• RepositorySystemSession.getUpdatePolicy()