Re: svn commit: r1763929 - /maven/shared/trunk/maven-artifact-transfer/src/main/java/org/apache/maven/shared/project/install/internal/DefaultProjectInstaller.java

2016-10-08 Thread Guillaume Boué
Hi, From what I checked, I don't think those plugins should be impacted since they use the ArtifactInstaller directly, and not the ProjectInstaller. But I can add an overload taking an ArtifactRepository which would get the path to the artifact with "artifactRepository.pathOf(artifact)". And

Re: svn commit: r1763929 - /maven/shared/trunk/maven-artifact-transfer/src/main/java/org/apache/maven/shared/project/install/internal/DefaultProjectInstaller.java

2016-10-08 Thread Robert Scholte
Hi Guillaume, although this is often true, there are some plugins which create their own local repository, for instance maven-invoker-plugin and maven-dependency-plugin. In those cases you should pass the ArtifactRepository. So we will need those versions too, either as overloaded method or

Re: [jira] [Commented] (MSHARED-594) NullPointerException is thrown when trying to install a project without POM file

2016-10-08 Thread Guillaume Boué
Hi, It is allowed by install:install-file when you set generatePom=false. It would install for example a JAR without any POM. It is true that you won't be able to depend on the artifact as-is... perhaps we should force generatePom=true then? This was a corner-case that I hit for https://iss

Re: [jira] [Commented] (MSHARED-594) NullPointerException is thrown when trying to install a project without POM file

2016-10-08 Thread Karl Heinz Marbaise
Hi Guillaume, On 08/10/16 20:30, Guillaume Boué (JIRA) wrote: When creating in-memory Maven projects with the {{ProjectBuilder}}, > it could not have a POM file: the intent is that > it only has attached artifacts and only those should get installed. Maybe I misunderstand a thing here... But

Re: Warning when artifacts are downloaded over an insecure channel

2016-10-08 Thread Alexander Kjäll
I tried to write a patch for this, and I don't think this is really possible to do without introducing some sort of state in order to avoid duplicate messages, I also ran into the issue that a repository definition might not be used as it might be overridden by another definition, so issuing warnin

Re: is maven plugin project alive?

2016-10-08 Thread Hervé BOUTEMY
in addition, there is more than 40 plugins in this git mirror http://maven.apache.org/plugins/ (that's one of the reason for hesitating to migrate one svn repo with one CI job to 40 git repos with 40 CI jobs) 18 open PRs (I don't know in which state) for 40 plugins (and 76 closed): very good hea

Re: Warning when artifacts are downloaded over an insecure channel

2016-10-08 Thread Alexander Kjäll
I liked the idea to only issue warnings about repository urls and not for every download, that would greatly reduce the amount of duplicated information. I think it might be user friendly to inform when someone has configured their project so that it disables the security model of maven, but maybe

Re: is maven plugin project alive?

2016-10-08 Thread Robert Scholte
Hi, it is not possible to merge these pullrequests at github, it is a read-only clone. And in case of the plugins, they are still in a subversion repository for a reason. Personally I only look at Jira[1] for issues. If there's an issue referring to a github pullrequest, that's the time to

Re: Warning when artifacts are downloaded over an insecure channel

2016-10-08 Thread Robert Scholte
It should be possible to run any build without a warning. We cannot assume that every http connection also has a https connection. Maven is only aware of one URL and that's the one to Central. This has already been changed to https. Other URL's are specified in the settings.xml, (direct) po