[MNG-7694] Maven 3.9.0 switched to HttpTransporter from WagonTransporter, breaking downloads from server using self-signed SSL-certs

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.9.0
• Component/s: Artifacts and Repositories
• Environment: Bitbucket pipeline build using maven:3.9.0-eclipse-temurin-8 docker image.
• Assignee: Unassigned
• Reporter: Rupinder S. Gill
• Created: 16/Feb/23 15:08
• Updated: 16/Feb/23 16:07
• Resolved: 16/Feb/23 16:07

Description

Our Bitbucket pipeline stopped working this morning, failing to download a plugin from our maven repository (Reposilite) that uses self-signed SSL-certificate.  We are passing "-Dmaven.http.ssl.insecure=true" option to mvn and all versions of maven up-to 3.8.7 work fine. 

Doing some digging with the -X option, we discovered that our pipeline was now using maven 3.9.0, which no longer uses WagonTransporter.  Instead, HttpTransporter is used, which is raising "SunCertPathBuilderException: unable to find valid certification path to requested target" exception (similar to what WagonTransporter would do without the "-Dmaven.http.ssl.insecure=true" option.

Issue Links

• duplicates: MNG-7685 Unable to ignore certificate errors with v3.9.0