[GIRAPH-1120] Insecure repository configuration

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.3.0
• Fix Version/s: 1.3.0
• Component/s: build
• Assignee: Unassigned
• Reporter: Olaf Flebbe
• Created: 11/Oct/16 05:30
• Updated: 21/Oct/16 23:48

Description

Hi, the repository configuration of giraph is dangerous, since it is susceptible for mitm attacks.

<repositories>
    <repository>
      <id>central</id>
      <url>http://repo1.maven.org/maven2</url>
      <releases>
        <enabled>true</enabled>
      </releases>
    </repository>
...

If one looks closer, no repository is needed to be configured since everything from the default profile is in maven central.

If anything from a non-default profile is not found in maven central, it should be moved to the respective profile. For instance the CDH artifact repository should be moved to the cdh hadoop_cdh4.1.2 profile.