[MPIR-473] Do not leak requests to outside repositories

[jira-importer]

Carsten Pfeiffer opened MPIR-473 and commented

When using a custom settings.xml or repositories configured in the pom, we should make sure to honor this and only ever contact these repositories for dependencies.

See this output where certain repositories even those found in transitive dependencies are contacted. Not only does this lead to lots of unneeded requests, it also leaks groupIds and artifactIds to these servers.

11:57:20.026 [DEBUG] Failure to find com.example:myartifact:1.19.0-SNAPSHOT/maven-metadata.xml in https://maven.java.net/content/repositories/snapshots was cached in the local repository, resolution will not be reattempted until the update interval of jvnet-nexus-snapshots has elapsed or updates are forced
11:57:20.028 [DEBUG] Failure to find com.example:myartifact:1.19.0-SNAPSHOT/maven-metadata.xml in https://repository.jboss.org/nexus/content/repositories/public/ was cached in the local repository, resolution will not be reattempted until the update interval of JBOSS has elapsed or updates are forced
11:57:20.031 [DEBUG] Failure to find com.example:myartifact:1.19.0-SNAPSHOT/maven-metadata.xml in https://oss.sonatype.org/content/repositories/snapshots was cached in the local repository, resolution will not be reattempted until the update interval of sonatype-nexus-snapshots has elapsed or updates are forced
11:57:20.033 [DEBUG] Failure to find com.example:myartifact:1.19.0-SNAPSHOT/maven-metadata.xml in https://oss.sonatype.org/content/repositories/snapshots was cached in the local repository, resolution will not be reattempted until the update interval of snapshots-repo has elapsed or updates are forced
11:57:20.036 [DEBUG] Failure to find com.example:myartifact:1.19.0-SNAPSHOT/maven-metadata.xml in https://oss.sonatype.org/content/repositories/releases was cached in the local repository, resolution will not be reattempted until the update interval of sonatype-releases has elapsed or updates are forced

---

Remote Links:

• GitHub Pull Request #92
  

[jira-importer]

Michael Osipov commented

cstamas

[Volodjam]

The issue appears to have been (indirectly) fixed in version 3.9.0 via #94, by replacing the method ProjectInfoReportUtils.getArtifactUrl() with ProjectInfoReportUtils.getProjectUrl().

I've added an integration test for this issue to the branch of the obsolete and already closed PR #92. The test fails on the project state before #94 and passes afterward. I can create a new PR to add the test, or the existing one could be reopened if there's interest.