[WAGON-346] LightWeight http wagon not thread-safe

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0
• Fix Version/s: 2.0
• Component/s: wagon-http-lightweight
• Environment: maven 3 with Aether
• Assignee: Unassigned
• Reporter: nicolas de loof
• Created: 22/Aug/11 11:51
• Updated: 04/May/18 22:56
• Resolved: 05/Sep/11 03:32

Description

Aether (maven3) by default parallelized metadata resolution on 4 threads (aether.metadataResolver.threads) and artifacts downloading on 5 (maven.artifact.threads).
In such context, Wagon is not used sequentially.
LightWeightHttpWagon is designed for mono-thread, sequential usage. It rely on system properties and on setting/resetting java.net.Authenticator singleton.
The result is that, in some cases (typically : when settings defines many repositories with various credentials), credentials may not apply and download will fail

A potential fix is

• to use Java5 URL.openConnection(Proxy) instead of using system properties
• to use a shared, singleton java.net.Authenticator that lookup repositories to match the requested URL

Issue Links

• is related to: WAGON-308 Use of proxy properties in lightweight http wagon is not thread-safe