gnodet commented on code in PR #2090:
URL: https://github.com/apache/maven-resolver/pull/2090#discussion_r3890841257
##########
maven-resolver-impl/src/main/java/org/eclipse/aether/impl/RemoteRepositoryManager.java:
##########
@@ -54,6 +54,44 @@ List<RemoteRepository> aggregateRepositories(
List<RemoteRepository> recessiveRepositories,
boolean recessiveIsRaw);
+ /**
+ * Aggregates repository definitions by merging duplicate repositories and
optionally applies mirror, proxy and
+ * authentication settings from the supplied session, additionally
distinguishing the provenance of the recessive
+ * repository definitions. Repository definitions that originate from a
remote artifact descriptor (i.e. a POM
+ * downloaded during dependency collection) are remotely supplied input:
implementations may withhold session
+ * authentication from them unless an operator-defined mirror has been
selected for them, so that session
+ * authentication is applied only to repositories the operator configured.
Repository definitions supplied
+ * by the build itself (e.g. via
+ * {@code RepositorySystem#newResolutionRepositories}) must keep receiving
mirror, proxy and authentication
+ * settings as documented for
+ * {@link #aggregateRepositories(RepositorySystemSession, List, List,
boolean)}.
+ * <p>
+ * The default implementation ignores the provenance hint and delegates to
+ * {@link #aggregateRepositories(RepositorySystemSession, List, List,
boolean)}.
+ *
+ * @param session The repository session during which the repositories
will be accessed, must not be {@code null}.
+ * @param dominantRepositories The current list of remote repositories to
merge the new definitions into, must not
+ * be {@code null}.
+ * @param recessiveRepositories The remote repositories to merge into the
existing list, must not be {@code null}.
+ * @param recessiveIsRaw {@code true} if the recessive repository
definitions have not yet been subjected to mirror,
+ * proxy and authentication settings, {@code false} otherwise.
+ * @param recessiveIsFromDescriptor {@code true} if the recessive
repository definitions were declared by a remote
+ * artifact descriptor (POM) rather than by the build itself,
{@code false} otherwise.
+ * @return The aggregated list of remote repositories, never {@code null}.
+ * @since 2.0.22
Review Comment:
`@since 2.0.22` is incorrect — version 2.0.22 was released on 2026-08-20
without this method. Should be `@since 2.0.23`.
```suggestion
* @since 2.0.23
```
##########
maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/DefaultRemoteRepositoryManager.java:
##########
@@ -53,6 +55,30 @@
@Named
public class DefaultRemoteRepositoryManager implements RemoteRepositoryManager
{
+ private static final String CONFIG_PROPS_PREFIX =
+ ConfigurationProperties.PREFIX_AETHER + "remoteRepositoryManager.";
+
+ /**
+ * Flag indicating whether session authentication (i.e. credentials
configured in {@code settings.xml}) may be
+ * applied, matched by plain repository ID, to repositories declared by
remote artifact descriptors (POMs) that
+ * are merged into the effective repository list during dependency
collection. When disabled (the default),
+ * session authentication is only applied to such a repository when an
operator-defined mirror has been selected
+ * for it; if credentials would have matched a descriptor-declared
repository, a warning naming the repository ID
+ * and URL is logged instead. Repositories supplied by the build itself
(e.g. aggregated via
+ * {@code RepositorySystem#newResolutionRepositories}) are unaffected and
keep receiving matching credentials.
+ * Enabling this restores the legacy behavior of applying matching session
authentication to descriptor
+ * declared repositories regardless of their provenance.
+ *
+ * @since 2.0.22
+ * @configurationSource {@link
RepositorySystemSession#getConfigProperties()}
Review Comment:
Same `@since` issue — should be `2.0.23`.
```suggestion
* @since 2.0.23
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
