[MNG-7118] Block external HTTP repositories by default

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.6.3
• Fix Version/s: 3.8.1, 4.0.0-alpha-2, 4.0.0
• Assignee: Herve Boutemy
• Reporter: Herve Boutemy
• Created: 14/Mar/21 18:54
• Updated: 20/Oct/22 08:11
• Resolved: 19/Mar/21 21:31

Description

Downloading code from external repositories in HTTP is not a best practice: let's block that by default

Using the 2 previously added features (MNG-7116 mirrorOf external:http:* to select repositories, and MNG-7117 to block the mirror), it can be done by adding a new mirror definition in default settings.xml provided in the Maven distribution:

<settings>
  <mirrors>
    <mirror>
      <id>maven-default-http-blocker</id>
      <mirrorOf>external:http:*</mirrorOf>
      <name>Pseudo repository to mirror external repositories initially using HTTP.</name>
      <url>http://0.0.0.0/</url>
      <blocked>true</blocked>
    </mirror>
  </mirrors>
</settings>

Issue Links

• causes: MNGSITE-450 Incorrect doc for using internal repo
• depends upon: MNG-7116 Add support for mirror selector on external:http:*
• depends upon: MNG-7117 Add support for blocking mirrors