ascheman commented on issue #13100: URL: https://github.com/apache/maven/issues/13100#issuecomment-5652965141
Good questions — worth pinning down, because there are actually **two separate axes** in `03c947d8` that got entangled: **1 · Profile *activation* in resolved models.** Suppressing property/file-activated profiles in a repository-resolved POM is what broke RESTEasy (#13084): its BOM is imported by a default-on negated-property profile (`!resteasy.dependencies.eap`) that got filtered out → missing managed versions. #13095 narrows that to re-allow the negated (default-on, non-injectable) case. That's the activation axis. **2 · Repository stripping** — the axis you're raising, and I agree it deserves its own scrutiny. On "why profiles only, not POM-body repos?": as I read it, in a *resolved* model profiles are activated against the **consumer's** environment (`-D`, files, JDK), which is meaningless for a published artifact — so a profile the publisher meant to be inactive can fire in my build and inject its repository. POM-body repos are unconditional (always present, part of the artifact's declared identity), so they stay honored — which is exactly why the `project → dep1 → dep2` pattern (dep1 declaring dep2's non-Central repo) keeps working **as long as the repo is in the POM body**. But your point stands: if dep1 declares that repo inside a profile (activeByDefault, or a negated default-on profile), the blanket strip breaks it — legitimate functionality lost to a coarse rule. Your redefine-centric framing is the better-targeted model: - **Honor** declared repositories (body and legitimately-active profiles). - **Scrutinize *redefinition*** of an already-known repository (especially `central`) — that's the actual attack (silent redirect to a malicious mirror), independent of whether the declaration sits in a profile or the body. - **WARN by default, with a WARN/FAIL switch** — the silent redirect is the dangerous part; making it visible is most of the value (ties back to #428). Net: I'd keep #13095 (it fixes the acute activation regression within today's model) and treat this issue as the follow-up that reconsiders the *repository* axis properly — replacing "strip all profile repos" with "detect + warn/fail on repository redefinition." Happy to help shape that. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
