Why does Hybris ship insecure http maven repository URL? And why can't we override it?

Question

In apache-ant/lib/libraries.properties

m2.repo=http://repo1.maven.org/maven2/

What is the point of shipping Hybris with http URL?
It cannot be accessed in the first place, let alone used for downloading.
Ideally, it should be an https URL.

m2.repo=https://repo1.maven.org/maven2/

I tried overriding it by redeclaring this property in local.properties. When that did not pick the new value, I changed it to https in apache-ant/lib/libraries.properties, but it is still picking http. How to override this property?

Error logs:

[artifact:mvn] Downloading: org/apache/maven/apache-maven/3.2.5/apache-maven-3.2.5.pom from repository central at http://repo1.maven.org/maven2
[artifact:mvn] Error transferring file: Operation timed out (Connection timed out)
[artifact:mvn] [WARNING] Unable to get resource 'org.apache.maven:apache-maven:pom:3.2.5' from repository central (http://repo1.maven.org/maven2): Error transferring file: Operation timed out (Connection timed out)
     [null] An error has occurred while processing the Maven artifact tasks.
     [null]  Diagnosis:
     [null] 
     [null] Unable to resolve artifact: Missing:
     [null] ----------
     [null] 1) org.apache.maven:apache-maven:pom:3.2.5
     [null]   Path to dependency: 
     [null]     1) org.apache.maven:super-pom:pom:2.0
     [null]     2) org.apache.maven:apache-maven:pom:3.2.5
     [null] 
     [null] ----------
     [null] 1 required artifact is missing.
     [null] 
     [null] for artifact: 
     [null]   org.apache.maven:super-pom:pom:2.0
     [null] 
     [null] from the specified remote repositories:
     [null]   central (http://repo1.maven.org/maven2)
     [null] 
     [null] 

BUILD FAILED

Great finding! +1 for posting it. – Arvind Kumar Avinash Jan 30 '20 at 21:26 — Arvind Kumar Avinash, Jan 30 '20 at 21:26

score 9 · Accepted Answer · answered Jan 29 '20 at 20:55

You can override this by setting up your $HOME/.m2/settings.xml file.

For example:

    <?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
    <profiles>
        <profile>
            <id>default</id>
            <repositories>
                <repository>
                    <releases>
                        <enabled>true</enabled>
                    </releases>
                    <snapshots>
                        <enabled>true</enabled>
                    </snapshots>
                    <id>central</id>
                    <url>https://repo1.maven.org/maven2</url>
                </repository>
            </repositories>
            <pluginRepositories>
                <pluginRepository>
                    <releases>
                        <enabled>true</enabled>
                    </releases>
                    <snapshots>
                        <enabled>true</enabled>
                    </snapshots>
                    <id>central</id>
                    <url>https://repo1.maven.org/maven2</url>
                </pluginRepository>
            </pluginRepositories>
        </profile>
    </profiles>

    <activeProfiles>
        <activeProfile>default</activeProfile>
    </activeProfiles>

</settings>

Arvind Kumar Avinash · Answer 2 · 2020-01-29T23:43:26.653

1

Redeclaring m2.repo in local.properties won't work as there is no such property loaded by Hybris. You can verify it by searching for m2.repo in hAC > Platform > Configuration (or simply at https://localhost:9002/platform/config).

Modifying it in apache-ant/lib/libraries.properties should work if you execute ant. Please let me know if it is not the case and I will try to find some other option.

When that did not pick the new value, I changed it to https in apache-ant/lib/libraries.properties, but it is still picking http. How to override this property?

It would be helpful if you mention where do you see it picking http. Please mention the steps to replicate this behavior.

edited Jan 29 '20 at 23:43

answered Jan 29 '20 at 23:16

Arvind Kumar Avinash

71,965
6
74
110

great to hear from you sir....we worked together in Medtronics..... I am getting the error as a last line in `ant clean all`.....when I set `usemaven=true` as one of the attributes..... – Farrukh Chishti Jan 30 '20 at 14:07
1

What a surprise! I saw your name a few times but couldn't recognize you because you haven't used your own picture at the DP. I hope you are doing well and I am sure you must be an asset to your team. I wish you a very successful career! Coming back to your problem, I was able to replicate the issue in my system when I updated the `external-dependendencies.xml` in a custom extension and changed `usemaven=true` in its `extensioninfo.xml`. Then, I tried the solution provided by `Neil Hubert-Price` and it worked. Please do accept his answer so that others can also use it confidently. – Arvind Kumar Avinash Jan 30 '20 at 21:14
1

It has also been answered at https://answers.sap.com/questions/12957190/maven-central-repository-link-broken.html – Arvind Kumar Avinash Jan 30 '20 at 23:10

Why does Hybris ship insecure http maven repository URL? And why can't we override it?

2 Answers2