gnodet-bot commented on code in PR #995: URL: https://github.com/apache/maven/pull/995#discussion_r4014975968
########## maven-embedder/src/main/java/org/apache/maven/cli/RemoteRepositoryConnectionVerifier.java: ########## @@ -0,0 +1,94 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.maven.cli; + +import java.net.URI; +import java.util.Optional; + +import org.apache.maven.RepositoryUtils; +import org.apache.maven.artifact.repository.ArtifactRepository; +import org.codehaus.plexus.PlexusContainer; +import org.codehaus.plexus.component.repository.exception.ComponentLookupException; +import org.eclipse.aether.RepositorySystemSession; +import org.eclipse.aether.repository.RemoteRepository; +import org.eclipse.aether.spi.connector.transport.GetTask; +import org.eclipse.aether.spi.connector.transport.Transporter; +import org.eclipse.aether.spi.connector.transport.TransporterProvider; +import org.eclipse.aether.transfer.NoTransporterException; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** + * Helper class to verify connection to a remote repository. + */ +public class RemoteRepositoryConnectionVerifier { + private final Logger logger; + private final TransporterProvider transporterProvider; + + public RemoteRepositoryConnectionVerifier(final PlexusContainer container) throws ComponentLookupException { + this.logger = LoggerFactory.getILoggerFactory().getLogger(RemoteRepositoryConnectionVerifier.class.getName()); + this.transporterProvider = container.lookup(TransporterProvider.class); + } + + public Optional<String> verifyConnectionToRemoteRepository( + final RepositorySystemSession session, final ArtifactRepository artifactRepository) { + final RemoteRepository repository = RepositoryUtils.toRepo(artifactRepository); + + try { + final Transporter transporter = transporterProvider.newTransporter(session, repository); + return verifyConnectionUsingTransport(transporter, repository); + } catch (final NoTransporterException nte) { + final String message = String.format( + "There is no compatible transport for remote repository '%s' with location '%s'", + repository.getId(), repository.getUrl()); + return Optional.of(message); + } + } Review Comment: 🐛 **Resource leak: `Transporter` is `Closeable` but never closed.** `Transporter extends java.io.Closeable`. The transporter obtained here is passed to `verifyConnectionUsingTransport()` and then abandoned — no `try-with-resources`, no explicit `close()`. The underlying HTTP connections or file handles held by the transporter will leak for every repository checked. ```suggestion try (final Transporter transporter = transporterProvider.newTransporter(session, repository)) { return verifyConnectionUsingTransport(transporter, repository); } catch (final NoTransporterException nte) { final String message = String.format( "There is no compatible transport for remote repository '%s' with location '%s'", repository.getId(), repository.getUrl()); return Optional.of(message); } ``` ########## maven-embedder/src/main/java/org/apache/maven/cli/MavenStatusCommand.java: ########## @@ -0,0 +1,214 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.maven.cli; + +import java.io.File; +import java.io.IOException; +import java.net.URI; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.ArrayList; +import java.util.Collection; +import java.util.Collections; +import java.util.Comparator; +import java.util.List; +import java.util.stream.Collectors; +import java.util.stream.Stream; + +import org.apache.maven.api.ArtifactCoordinate; +import org.apache.maven.api.Session; +import org.apache.maven.api.services.ArtifactResolver; +import org.apache.maven.api.services.ArtifactResolverException; +import org.apache.maven.api.services.ArtifactResolverResult; +import org.apache.maven.artifact.repository.ArtifactRepository; +import org.apache.maven.bridge.MavenRepositorySystem; +import org.apache.maven.execution.DefaultMavenExecutionResult; +import org.apache.maven.execution.MavenExecutionRequest; +import org.apache.maven.execution.MavenExecutionRequestPopulationException; +import org.apache.maven.execution.MavenExecutionRequestPopulator; +import org.apache.maven.execution.MavenSession; +import org.apache.maven.internal.impl.DefaultArtifactCoordinate; +import org.apache.maven.internal.impl.DefaultSessionFactory; +import org.apache.maven.internal.impl.InternalMavenSession; +import org.apache.maven.internal.impl.InternalSession; +import org.apache.maven.resolver.RepositorySystemSessionFactory; +import org.apache.maven.session.scope.internal.SessionScope; +import org.codehaus.plexus.PlexusContainer; +import org.codehaus.plexus.component.repository.exception.ComponentLookupException; +import org.eclipse.aether.RepositorySystemSession; +import org.eclipse.aether.artifact.Artifact; +import org.eclipse.aether.artifact.DefaultArtifact; +import org.eclipse.aether.resolution.ArtifactResolutionException; +import org.eclipse.aether.resolution.ArtifactResult; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class MavenStatusCommand { + private static final Logger LOGGER = LoggerFactory.getLogger(MavenStatusCommand.class); + + /** + * In order to verify artifacts can be downloaded from the remote repositories we want to resolve an actual + * artifact. The Apache Maven artifact was chosen as it eventually, be it by proxy, mirror or directly, will be + * gathered from the central repository. The version is chosen arbitrarily since any listed should work. + */ + public static final Artifact APACHE_MAVEN_ARTIFACT = + new DefaultArtifact("org.apache.maven", "apache-maven", null, "pom", "3.8.6"); + + private final MavenExecutionRequestPopulator mavenExecutionRequestPopulator; + private final ArtifactResolver artifactResolver; + private final RemoteRepositoryConnectionVerifier remoteRepositoryConnectionVerifier; + private final DefaultSessionFactory defaultSessionFactory; + private final RepositorySystemSessionFactory repoSession; + private final MavenRepositorySystem repositorySystem; + private final SessionScope sessionScope; + private Path tempLocalRepository; + + public MavenStatusCommand(final PlexusContainer container) throws ComponentLookupException { + this.remoteRepositoryConnectionVerifier = new RemoteRepositoryConnectionVerifier(container); + this.mavenExecutionRequestPopulator = container.lookup(MavenExecutionRequestPopulator.class); + this.artifactResolver = container.lookup(ArtifactResolver.class); + this.defaultSessionFactory = container.lookup(DefaultSessionFactory.class); + this.repoSession = container.lookup(RepositorySystemSessionFactory.class); + this.sessionScope = container.lookup(SessionScope.class); + this.repositorySystem = container.lookup(MavenRepositorySystem.class); + } + + public List<String> verify(final MavenExecutionRequest cliRequest) throws MavenExecutionRequestPopulationException { + final MavenExecutionRequest mavenExecutionRequest = mavenExecutionRequestPopulator.populateDefaults(cliRequest); + + final ArtifactRepository localRepository = cliRequest.getLocalRepository(); + + final List<String> localRepositoryIssues = + verifyLocalRepository(Paths.get(URI.create(localRepository.getUrl()))); + + // We overwrite the local repository with a temporary directory to avoid using a cached version of the artifact. + setTemporaryLocalRepositoryPathOnRequest(cliRequest); + + final List<String> remoteRepositoryIssues = + verifyRemoteRepositoryConnections(cliRequest.getRemoteRepositories(), mavenExecutionRequest); + final List<String> artifactResolutionIssues = verifyArtifactResolution(mavenExecutionRequest); + + cleanupTempFiles(); + + // Collect all issues into a single list + return Stream.of(localRepositoryIssues, remoteRepositoryIssues, artifactResolutionIssues) + .flatMap(Collection::stream) + .collect(Collectors.toList()); + } Review Comment: 🐛 **`cleanupTempFiles()` is not in a `try-finally` block — temp directory leaks on exception.** If `verifyRemoteRepositoryConnections()` (line 110) or `verifyArtifactResolution()` (line 112) throws an unchecked exception (e.g. `RuntimeException` from a Plexus component failure), execution jumps past line 114 and the temp directory created by `setTemporaryLocalRepositoryPathOnRequest()` is never deleted. ```suggestion try { final List<String> remoteRepositoryIssues = verifyRemoteRepositoryConnections(cliRequest.getRemoteRepositories(), mavenExecutionRequest); final List<String> artifactResolutionIssues = verifyArtifactResolution(mavenExecutionRequest); // Collect all issues into a single list return Stream.of(localRepositoryIssues, remoteRepositoryIssues, artifactResolutionIssues) .flatMap(Collection::stream) .collect(Collectors.toList()); } finally { cleanupTempFiles(); } ``` ########## maven-embedder/src/main/java/org/apache/maven/cli/MavenCli.java: ########## @@ -284,6 +287,7 @@ public int doMain(CliRequest cliRequest) { configure(cliRequest); toolchains(cliRequest); populateRequest(cliRequest); + status(cliRequest); encryption(cliRequest); return execute(cliRequest); } catch (ExitException e) { Review Comment: ⚠️ **`status()` called before `slf4jLoggerFactory` is initialized in this code path.** The PR's `status()` method starts with `slf4jLoggerFactory = LoggerFactory.getILoggerFactory();`. However, `logging()` in `doMain()` already does this — the reassignment in `status()` is redundant and suggests the method was written in isolation. More importantly, if `status()` is ever moved earlier in the call chain (e.g., before `logging()` is called), the logger setup would depend on this side-effecting reassignment. Remove the reassignment from `status()` — it should rely on the initialization done by `logging()`. ########## maven-embedder/src/main/java/org/apache/maven/cli/MavenStatusCommand.java: ########## @@ -0,0 +1,214 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.maven.cli; + +import java.io.File; +import java.io.IOException; +import java.net.URI; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.ArrayList; +import java.util.Collection; +import java.util.Collections; +import java.util.Comparator; +import java.util.List; +import java.util.stream.Collectors; +import java.util.stream.Stream; + +import org.apache.maven.api.ArtifactCoordinate; +import org.apache.maven.api.Session; +import org.apache.maven.api.services.ArtifactResolver; +import org.apache.maven.api.services.ArtifactResolverException; +import org.apache.maven.api.services.ArtifactResolverResult; +import org.apache.maven.artifact.repository.ArtifactRepository; +import org.apache.maven.bridge.MavenRepositorySystem; +import org.apache.maven.execution.DefaultMavenExecutionResult; +import org.apache.maven.execution.MavenExecutionRequest; +import org.apache.maven.execution.MavenExecutionRequestPopulationException; +import org.apache.maven.execution.MavenExecutionRequestPopulator; +import org.apache.maven.execution.MavenSession; +import org.apache.maven.internal.impl.DefaultArtifactCoordinate; +import org.apache.maven.internal.impl.DefaultSessionFactory; +import org.apache.maven.internal.impl.InternalMavenSession; +import org.apache.maven.internal.impl.InternalSession; +import org.apache.maven.resolver.RepositorySystemSessionFactory; +import org.apache.maven.session.scope.internal.SessionScope; +import org.codehaus.plexus.PlexusContainer; +import org.codehaus.plexus.component.repository.exception.ComponentLookupException; +import org.eclipse.aether.RepositorySystemSession; +import org.eclipse.aether.artifact.Artifact; +import org.eclipse.aether.artifact.DefaultArtifact; +import org.eclipse.aether.resolution.ArtifactResolutionException; +import org.eclipse.aether.resolution.ArtifactResult; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class MavenStatusCommand { + private static final Logger LOGGER = LoggerFactory.getLogger(MavenStatusCommand.class); + + /** + * In order to verify artifacts can be downloaded from the remote repositories we want to resolve an actual + * artifact. The Apache Maven artifact was chosen as it eventually, be it by proxy, mirror or directly, will be + * gathered from the central repository. The version is chosen arbitrarily since any listed should work. + */ + public static final Artifact APACHE_MAVEN_ARTIFACT = + new DefaultArtifact("org.apache.maven", "apache-maven", null, "pom", "3.8.6"); + + private final MavenExecutionRequestPopulator mavenExecutionRequestPopulator; + private final ArtifactResolver artifactResolver; + private final RemoteRepositoryConnectionVerifier remoteRepositoryConnectionVerifier; + private final DefaultSessionFactory defaultSessionFactory; + private final RepositorySystemSessionFactory repoSession; + private final MavenRepositorySystem repositorySystem; + private final SessionScope sessionScope; + private Path tempLocalRepository; + + public MavenStatusCommand(final PlexusContainer container) throws ComponentLookupException { + this.remoteRepositoryConnectionVerifier = new RemoteRepositoryConnectionVerifier(container); + this.mavenExecutionRequestPopulator = container.lookup(MavenExecutionRequestPopulator.class); + this.artifactResolver = container.lookup(ArtifactResolver.class); + this.defaultSessionFactory = container.lookup(DefaultSessionFactory.class); + this.repoSession = container.lookup(RepositorySystemSessionFactory.class); + this.sessionScope = container.lookup(SessionScope.class); + this.repositorySystem = container.lookup(MavenRepositorySystem.class); + } + + public List<String> verify(final MavenExecutionRequest cliRequest) throws MavenExecutionRequestPopulationException { + final MavenExecutionRequest mavenExecutionRequest = mavenExecutionRequestPopulator.populateDefaults(cliRequest); + + final ArtifactRepository localRepository = cliRequest.getLocalRepository(); + + final List<String> localRepositoryIssues = + verifyLocalRepository(Paths.get(URI.create(localRepository.getUrl()))); + Review Comment: ⚠️ **`populateDefaults()` called on the live request that `doMain()` already partially initialized.** `MavenCli.doMain()` calls `populateRequest()` before `status()`, which already partially sets up the `MavenExecutionRequest`. Then `verify()` here calls `mavenExecutionRequestPopulator.populateDefaults(cliRequest)` on the same request object. `populateDefaults()` is not idempotent — calling it twice can overwrite settings (e.g. local repository, active profiles, system properties) that were already configured based on user input. The result on line 100 (`mavenExecutionRequest`) is discarded — the populated version is used for remote repo/resolution checks, but the original `cliRequest` (now double-populated) is what gets mutated by `setTemporaryLocalRepositoryPathOnRequest()` on line 108. This is confusing and fragile. At minimum, `populateDefaults()` should be called on a copy of the request, not the live one. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
