[MNG-7685] Unable to ignore certificate errors with v3.9.0

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.9.0
• Fix Version/s: 3.9.1
• Component/s: Core
• Labels: Regression
• Environment: Linux and Mac
• Assignee: Tamas Cservenak
• Reporter: John Patrick
• Created: 06/Feb/23 21:25
• Updated: 11/Mar/23 19:25
• Resolved: 11/Mar/23 19:25

Description

Setting `-Dmaven.wagon.http.ssl.insecure=true` via `.mvn/jvm.config` does not work with v3.9.0, but works with v3.8.7. i.e. when executing `./mvnw org.apache.maven.plugins:maven-dependency-plugin:3.5.0:go-offline`.

I've got a minishift instance running jenkins, with agents created on demand. I've got a nexus with a self signed certificate and for simpler out of the box Jenkins agents I'm happy for it to ignore the nexus certificate error. So Jenkins uses config-file-provider plugin to provide `jvm.config` and for builds to ignore certificate issues.

Not sure if maven has;

1. stopped reading `.mvn/jvm.config`
2. stoped allowing multiple line `.mvn/jvm.config`
3. not setting System properties as defined in `.mvn/jvm.config`
4. wagon upgrade has introduced bug or new config

Issue Links

• is duplicated by: MNG-7687 Ignoring SSL using -Dmaven.wagon.http.ssl.insecure=true not working on 3.9.0
• is duplicated by: MNG-7694 Maven 3.9.0 switched to HttpTransporter from WagonTransporter, breaking downloads from server using self-signed SSL-certs
• is fixed by: MRESOLVER-328 The transport-http should be able to ignore cert errors
• is fixed by: MNG-7715 Upgrade to Maven Resolver 1.9.6