slachiewicz opened a new pull request, #13008: URL: https://github.com/apache/maven/pull/13008
Repositories declared by a model that was resolved from a repository (a dependency POM, or a parent or import reached from one) are remotely supplied input, but they were aggregated with the same `aggregate` call as build-supplied repositories, so a `<server>` in `settings.xml` whose id matched a repository id in a downloaded POM had its credentials attached to that repository. maven-resolver 2.0.23 (apache/maven-resolver#2090) adds an `aggregateRepositories` overload with a provenance flag: descriptor-declared repositories receive session authentication only when an operator-defined mirror captures them, and `aether.remoteRepositoryManager.authToDescriptorRepositories=true` restores the previous behaviour. This adds the matching five-argument `RepositoryFactory.aggregate` as a default method (delegating to the existing one, so other implementations are unaffected), passes the flag through `DefaultRepositoryFactory`, and sets it from `DefaultModelBuilder`'s existing `externalOrigin` and from the compat `DefaultModelResolver`, which only builds descriptor models. `ProjectModelResolver` builds the project's own model and parents, which are operator-chosen, and keeps the four-argument call. Blocked on the maven-resolver 2.0.23 release: the second commit bumps `resolverVersion` to `2.0.23-SNAPSHOT` as a build aid and must be dropped, and the first commit does not compile against 2.0.22. Verified: `mvn -pl api/maven-api-core,impl/maven-impl,compat/maven-resolver-provider -am -Dmaven.test.skip install` against 2.0.23-SNAPSHOT → compiles. The maven-impl test sources do not compile on current master independently of this change (`DistributionManagementArtifactRelocationSourceTest.noRelocationReturnsNull` calls a method that has declared `ArtifactDescriptorException` since #12950), so the module tests could not be run here. *This change was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
