slachiewicz opened a new pull request, #13008:
URL: https://github.com/apache/maven/pull/13008

   Repositories declared by a model that was resolved from a repository (a 
dependency POM, or a parent or import reached from one) are remotely supplied 
input, but they were aggregated with the same `aggregate` call as 
build-supplied repositories, so a `<server>` in `settings.xml` whose id matched 
a repository id in a downloaded POM had its credentials attached to that 
repository.
   
   maven-resolver 2.0.23 (apache/maven-resolver#2090) adds an 
`aggregateRepositories` overload with a provenance flag: descriptor-declared 
repositories receive session authentication only when an operator-defined 
mirror captures them, and 
`aether.remoteRepositoryManager.authToDescriptorRepositories=true` restores the 
previous behaviour. This adds the matching five-argument 
`RepositoryFactory.aggregate` as a default method (delegating to the existing 
one, so other implementations are unaffected), passes the flag through 
`DefaultRepositoryFactory`, and sets it from `DefaultModelBuilder`'s existing 
`externalOrigin` and from the compat `DefaultModelResolver`, which only builds 
descriptor models. `ProjectModelResolver` builds the project's own model and 
parents, which are operator-chosen, and keeps the four-argument call.
   
   Blocked on the maven-resolver 2.0.23 release: the second commit bumps 
`resolverVersion` to `2.0.23-SNAPSHOT` as a build aid and must be dropped, and 
the first commit does not compile against 2.0.22.
   
   Verified: `mvn -pl 
api/maven-api-core,impl/maven-impl,compat/maven-resolver-provider -am 
-Dmaven.test.skip install` against 2.0.23-SNAPSHOT → compiles. The maven-impl 
test sources do not compile on current master independently of this change 
(`DistributionManagementArtifactRelocationSourceTest.noRelocationReturnsNull` 
calls a method that has declared `ArtifactDescriptorException` since #12950), 
so the module tests could not be run here.
   
   *This change was created with AI assistance.*


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to