Upgrade aether #83
Upgrade aether #83
Conversation
This patch upgrades to the latest version of aether: 1.1.0. The change
makes the Pomegranade customization of the wagon unnecessary and
therefore the new internal repository-system does not include it
anymore:
(doto (MavenRepositorySystemUtils/newServiceLocator)
(.addService RepositoryConnectorFactory BasicRepositoryConnectorFactory)
(.addService TransporterFactory FileTransporterFactory)
(.addService TransporterFactory HttpTransporterFactory)
(.setErrorHandler error-handler))
Note that this is a bit different from the version in the released version, which includes an "http" and "https" entry in the factories atom; this falls back to the HttpTransporterFactory inside the ServiceLocator. It's unclear if there is any difference between the two approaches.
repo1.maven.org is not a proxy; why would you expect it to work like a proxy? It's a repository. Silly wabbit.
Test based on https://github.com/xeqi/pedantic; thanks to Nelson Morris/xeqi.
|
Just to make sure I grok the HTTPS-only change: it looks like this means any (@technomancy I have no problem with this at all, esp. insofar as you and others actively maintaining Leiningen are likely to find out just how many people are using janky http apache-served repos, old internal nexus installs, etc.) |
|
I'll get a release cut of this later today, I think. Thanks to @ryfow, @arichiardi, and @technomancy for putting this together. |
|
@cemerick thanks! teamwork! @technomancy Did you notice any positive side in bumping? I wonder if it actually improves things (it should, many bugs were solved). |
| @@ -83,6 +115,7 @@ | |||
| (clojure.stacktrace/print-cause-trace e)))] | |||
| (.getService | |||
| (doto (MavenRepositorySystemUtils/newServiceLocator) | |||
| (.setService WagonProvider PomegranateWagonProvider) | |||
|
@arichiardi the main positive side is that it no longer depends on libs which are in an unmaintained state. This will make it possible to have Leiningen distributed thru Debian repositories. I also took this chance to remove the non-TLS HTTP support, which is a very important benefit, but it is unrelated to the upgrade to the latest version. |
|
|
This builds on #80 but takes it a bit further.
Note that item 3 above is technically a breaking change; however I would argue it is a bugfix for a critical security flaw. It's still possible to explicitly opt-in to non-TLS HTTP repositories if you don't care for security by calling
register-wagon-factory!yourself.