kwin commented on code in PR #1731: URL: https://github.com/apache/maven-site/pull/1731#discussion_r4333793441
########## content/markdown/settings.md: ########## @@ -209,6 +209,70 @@ declared in `settings.xml`: you can see them with `mvn help:effective-settings`. An alias must not be empty, and it should be unique across all server IDs and aliases. Otherwise Maven reports a warning. +#### Server Repository Origins + +Since Maven 3.10.0 and 4.0.0, the credentials of a server are bound to the origins +(scheme, host and port) of the repositories and mirrors declared with the same +ID in `settings.xml`. + +When Maven starts, it takes into account only the repositories from `settings.xml` profiles Review Comment: This is probably a flaw we should get rid of. From a users pov this is hard to grasp. I think the rule should be: all id associations coming from the same file are considered secure origins, origins coming from other files need to be explicitly granted. ########## content/markdown/docs/3.10.0/release-notes.md: ########## @@ -137,20 +138,8 @@ set to `mild` or `off`, but the coordinates should be fixed instead. ### Repository credentials are scoped Credentials of a `settings.xml` server are only offered to repositories and mirrors whose origin Maven could associate -with that server id. A repository declared in a profile that is activated through `<activation>` or `-P` contributes no -origin, so its credentials have to be declared explicitly: - -```xml -<server> - <id>internal</id> - <username>u</username> - <password>p</password> - <repositoryOrigins> - <repositoryOrigin>https://repo.example.org</repositoryOrigin> - <repositoryOrigin>https://mirror.example.org:8443</repositoryOrigin> - </repositoryOrigins> -</server> -``` +with that server id. Origins Maven cannot find by itself can be declared with `<repositoryOrigins>`, see Review Comment: ```suggestion with that server id. Origins Maven cannot securely associate via id can be declared with `<repositoryOrigins>`, see ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
