slachiewicz opened a new issue, #13702: URL: https://github.com/apache/maven/issues/13702
### Affected version 3.10.x (`maven-3.10.x`). On master and 4.0.x only Maven's own build is affected, since there only the `apache-maven` module depends on it. ### Problem `javax.annotation:javax.annotation-api:1.3.2` has `net.java:jvnet-parent:3` as its parent, which declares `jvnet-nexus-releases` and `jvnet-nexus-snapshots` at `https://maven.java.net`. That host is shut down and serves an expired certificate. On 3.x, `maven-embedder` depends on it at compile scope, so every build that depends on `maven-embedder` reads `jvnet-parent` and adds those repositories to its remote repository list. Resolver 2's remote repository filter then fetches `.meta/prefixes.txt` from each of them: ``` [WARNING] Could not transfer metadata /.meta/prefixes.txt from/to jvnet-nexus-releases (https://maven.java.net/content/repositories/releases/): (certificate_expired) PKIX path validation failed ``` #13050 shows the same warning arriving through another `jvnet-parent` child. Running `mvn -X dependency:tree -pl maven-embedder` with Maven 4.0.0-rc-7 on `maven-3.10.x` lists `jvnet-nexus-snapshots (https://maven.java.net/content/repositories/snapshots)`. ### Proposal Switch to `jakarta.annotation:jakarta.annotation-api:1.3.5`, the EE4J continuation of the same API. The 1.3.x line keeps the `javax.annotation` packages (the rename to `jakarta.annotation` came in 2.0), and its parent declares no repositories. - Update the coordinates in dependencyManagement and `maven-embedder`. - Distribution LICENSE: the jar is dual-licensed EPL-2.0 or GPL-2.0 with Classpath Exception. The distribution elects EPL-2.0, as for Sisu. - Keep `javax.annotation:javax.annotation-api` in the `maven-core` `extension.xml` exported artifacts, so plugins and extensions that declare it still get core's copy. - Do not add the jakarta coordinates to the exported artifacts. The filter matches groupId:artifactId regardless of version, so it would also strip `jakarta.annotation-api` 2.x (the `jakarta.annotation` packages, which core does not ship) from plugin realms. Forward-port to master and 4.0.x for Maven's own build. Related: #7516 is about not exporting `javax.*` APIs at all; this change leaves the exports as they are. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
