slachiewicz commented on PR #12954: URL: https://github.com/apache/maven/pull/12954#issuecomment-5471972674
Related work in `maven-resolver`, for reviewer awareness: apache/maven-resolver#2090 adds a `RemoteRepositoryManager.aggregateRepositories` overload that carries the provenance of the recessive repository definitions, so an implementation can apply session authentication only to repositories the operator configured rather than to repositories declared by a downloaded artifact descriptor. It approaches the same question as this PR from the resolver side. The default implementation there delegates to the existing method, so nothing changes for callers that do not opt in. *This comment was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
