slachiewicz opened a new issue, #2289: URL: https://github.com/apache/maven-resolver/issues/2289
Follow-up to #1649, which is on hold because `minio-java` itself is still maintained. This proposes to keep the capability, change its foundation and its name, and leave the MinIO module untouched until the replacement has shipped. ## What the module does today `maven-resolver-transport-minio` is 704 lines and calls four things on the MinIO client: `statObject`, `getObject`, `uploadObject`, `close`. Credentials come only from the repository's username and password. The factory already accepts `s3+http(s)` next to `minio+http(s)`. ## Why move - `minio-java` is alive (9.0.4 on 2026-10-30, Apache-2.0, Java 8, 3 to 8 commits a month since March 2026), but the open-source server was archived on 2026-04-25 and the client's README now documents it as the SDK of the commercial AIStor product. Its direction is set by that product's needs. - Its runtime closure is 21.2 MB in 22 jars for those four calls: `bcprov-jdk18on` 7.2 MB, Guava, snappy-java, kotlin-stdlib, jackson-databind, commons-compress. That closure is what produced #2248 (Jackson and Netty advisories). - The S3 wagons in the wild are all third party; the two still maintained (`Allogy/maven-s3-wagon`, `michaelboyles/s3-maven-extension`) are on AWS SDK v2, `s3-wagon-private` is still on SDK v1, which reached end of support on 2025-12-31. As Wagon leaves the estate, this transport is where an `s3` repository lives, so it should carry the protocol's name. ## Candidates measured (runtime closure of a scratch POM, same method for each) | Client | Jars | Size | Notes | |---|---|---|---| | `io.minio:minio` 9.0.4 | 22 | 21.2 MB | see above | | `software.amazon.awssdk:s3` 2.57.11 + `url-connection-client`, Apache/Netty/CRT clients excluded | 32 | 8.9 MB | Java 8 bytecode, documented Java 8+; standard credential chain; since 2.30.0 needs `requestChecksumCalculation` and `responseChecksumValidation` set to `WHEN_REQUIRED` for non-AWS stores | | `com.github.davidmoten:aws-lightweight-client-java` 0.1.25 | 1 | 0.1 MB | SigV4, presign, multipart, custom endpoint; one maintainer | ## Proposal 1. Add `maven-resolver-transport-s3` on AWS SDK v2 (`s3` + `url-connection-client`), factory name `s3`, protocols `s3+http(s)`, path-style access and `WHEN_REQUIRED` checksums by default, credentials from the repository authentication when present and from the SDK default chain otherwise. Same object name mappers as today under `org.eclipse.aether.transport.s3`. 2. Give it a higher priority than the MinIO factory so that `s3+https` resolves to it when both modules are present; the MinIO module keeps `minio+http(s)`. 3. Once it has shipped in a 2.0.x release, deprecate `maven-resolver-transport-minio` and drop it in 2.1 (this is what #1649 then becomes). A PR for step 1 follows. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
