Bug 1040547 - EAP 6.2 maven repository exposes internal Red Hat links [NEEDINFO]
Summary: EAP 6.2 maven repository exposes internal Red Hat links
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: JBoss Enterprise Application Platform 6
Classification: JBoss
Component: Maven Repository
Version: 6.2.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: ---
Assignee: Peter Palaga
QA Contact: Nikoleta Hlavickova
Russell Dickenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-12-11 15:38 UTC by Travis Rogers
Modified: 2018-12-05 16:44 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-02-26 04:57:50 UTC
Type: Bug
bmaxwell: needinfo? (trogers)


Attachments (Terms of Use)

Description Travis Rogers 2013-12-11 15:38:34 UTC
A review of the EAP 6.2 maven repository shows internal Red Hat links are included and exposed.


somedude:~/jboss-eap-6.2.0.GA-maven-repository $ find . -name "*.pom" -exec grep -nH "\.redhat\.com" {} \;
./net/jcip/jcip-annotations/1.0.redhat-6/jcip-annotations-1.0.redhat-6.pom:23:    <connection>scm:git:git://git.app.eng.bos.redhat.com/jcip-annotations.git</connection>
./net/jcip/jcip-annotations/1.0.redhat-6/jcip-annotations-1.0.redhat-6.pom:24:    <developerConnection>scm:git:ssh://git.app.eng.bos.redhat.com/srv/git/jcip-annotations.git</developerConnection>
./net/jcip/jcip-annotations/1.0.redhat-6/jcip-annotations-1.0.redhat-6.pom:25:    <url>http://git.app.eng.bos.redhat.com/git/jcip-annotations.git</url>
./org/rhq/rhq-parent/4.0.1-redhat-2/rhq-parent-4.0.1-redhat-2.pom:37:    <url>https://bugzilla.redhat.com/browse.cgi?product=RHQ%20Project</url>
./org/jboss/as/jboss-as-parent/7.3.0.Final-redhat-14/jboss-as-parent-7.3.0.Final-redhat-14.pom:5741:      <url>http://download.lab.bos.redhat.com/brewroot/repos/jb-eap-6-rhel-6-build/latest/maven/</url>
./org/jboss/as/jboss-as-parent/7.3.0.Final-redhat-14/jboss-as-parent-7.3.0.Final-redhat-14.pom:5782:      <url>http://download.lab.bos.redhat.com/brewroot/repos/jb-eap-6-rhel-6-build/latest/maven/</url>
./org/apache/felix/org.apache.felix.configadmin/1.2.8.redhat-4/org.apache.felix.configadmin-1.2.8.redhat-4.pom:17:    <connection>scm:git:git://git.app.eng.bos.redhat.com/apache/org.apache.felix.configadmin.git</connection>
./org/apache/felix/org.apache.felix.configadmin/1.2.8.redhat-4/org.apache.felix.configadmin-1.2.8.redhat-4.pom:18:    <developerConnection>scm:git:ssh://git.app.eng.bos.redhat.com/apache/org.apache.felix.configadmin.git</developerConnection>
./org/apache/felix/org.apache.felix.configadmin/1.2.8.redhat-4/org.apache.felix.configadmin-1.2.8.redhat-4.pom:19:    <url>http://git.app.eng.bos.redhat.com/apache/org.apache.felix.configadmin.git</url>
./javax/jws/jsr181-api/1.0-MR1-redhat-6/jsr181-api-1.0-MR1-redhat-6.pom:27:    <connection>scm:git:git://git.app.eng.bos.redhat.com/jsr181-api.git</connection>
./javax/jws/jsr181-api/1.0-MR1-redhat-6/jsr181-api-1.0-MR1-redhat-6.pom:28:    <developerConnection>scm:git:git+ssh://git.app.eng.bos.redhat.com/srv/git/jsr181-api.git</developerConnection>
./javax/jws/jsr181-api/1.0-MR1-redhat-6/jsr181-api-1.0-MR1-redhat-6.pom:29:    <url>http://git.app.eng.bos.redhat.com/jsr181-api.git</url>
./javax/faces/jsf-project/1.2_15-b01-redhat-8/jsf-project-1.2_15-b01-redhat-8.pom:100:    <connection>scm:git:git://git.app.eng.bos.redhat.com/javaserverfaces-sources.git</connection>
./javax/faces/jsf-project/1.2_15-b01-redhat-8/jsf-project-1.2_15-b01-redhat-8.pom:101:    <developerConnection>scm:git:git+ssh://git.app.eng.bos.redhat.com/srv/git/javaserverfaces-sources.git</developerConnection>
./javax/faces/jsf-project/1.2_15-b01-redhat-8/jsf-project-1.2_15-b01-redhat-8.pom:102:    <url>http://git.app.eng.bos.redhat.com/javaserverfaces-sources.git</url>
./antlr/antlr/2.7.7.redhat-4/antlr-2.7.7.redhat-4.pom:26:    <connection>scm:git:git://git.app.eng.bos.redhat.com/antlr2.git</connection>
./antlr/antlr/2.7.7.redhat-4/antlr-2.7.7.redhat-4.pom:27:    <developerConnection>scm:git:ssh://code.engineering.redhat.com/antlr2.git</developerConnection>
./antlr/antlr/2.7.7.redhat-4/antlr-2.7.7.redhat-4.pom:28:    <url>http://git.app.eng.bos.redhat.com/git/antlr2.git</url>

Comment 1 Marek Novotny 2013-12-12 13:27:32 UTC
What I see as an issue is not the list above but what gives the following find command:
$ find . -type f -name *.pom -exec grep "<url>http://download." {} \; -print

      <url>http://download.lab.bos.redhat.com/brewroot/repos/jb-eap-6-rhel-6-build/latest/maven/</url>
      <url>http://download.lab.bos.redhat.com/brewroot/repos/jb-eap-6-rhel-6-build/latest/maven/</url>
./org/jboss/as/jboss-as-parent/7.3.0.Final-redhat-14/jboss-as-parent-7.3.0.Final-redhat-14.pom


The references to internal git repositories are not so big issue as that is internal and don't affect Maven dependency resolution as what is in org.jboss.as:jboss-as-parent:7.3.0.Final-redhat-14

Comment 2 Yeroc 2014-01-22 00:17:27 UTC
Those entries likely explain how it's possible for missing dependencies to slip into the maven repository without someone at RedHat noticing.  

For example, the eap6/6.2.0 repository (http://maven.repository.redhat.com/techpreview/eap6/6.2.0/) is currently still missing a few dependencies preventing builds from source.  I imagine fixing this issue would prevent this from happening so hope this gets fixed soonish...

Thanks!

Comment 3 Jay SenSharma 2014-02-18 11:54:11 UTC
Building EAP 6.2 from maven repository provided in the customer portal fails with the following error while building it from Outside of RedHat Network

{code}
 testRejectExpressionsEAP600(org.jboss.as.threads.ThreadsSubsystemTestCase): org.eclipse.aether.resolution.ArtifactResolutionException: Could not transfer artifact org.jboss.as:jboss-as-threads:jar:7.1.2.Final-redhat-1 from/to jboss-product-repository (http://download.lab.bos.redhat.com/brewroot/repos/jb-eap-6-rhel-6-build/latest/maven/): download.lab.bos.redhat.com

 testRejectExpressionsEAP601(org.jboss.as.threads.ThreadsSubsystemTestCase): org.eclipse.aether.resolution.ArtifactResolutionException: Could not transfer artifact org.jboss.as:jboss-as-threads:jar:7.1.3.Final-redhat-4 from/to jboss-product-repository (http://download.lab.bos.redhat.com/brewroot/repos/jb-eap-6-rhel-6-build/latest/maven/): download.lab.bos.redhat.com
 Caused by: java.net.UnknownHostException: download.lab.bos.redhat.com
{code}


The "JBoss Internal Product Repository"  is hardcoded in the following pom:
"jboss-eap-6.2.0.GA-maven-repository/org/jboss/as/jboss-as-parent/7.3.0.Final-redhat-14/jboss-as-parent-7.3.0.Final-redhat-14.pom"
 <url>http://download.lab.bos.redhat.com/brewroot/repos/jb-eap-6-rhel-6-build/latest/maven/</url>;



It also fails to resolve the following dependency while building because the "slf4j-simple" is present inside our *Internal Repository*  not in public repo or in the maven repo provided as part f customer portal.

      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-simple</artifactId>
        <version>${version.org.slf4j}</version>
      </dependency>

As "slf4j-simple" is missing in the Maven repository shipped via the customer portal hence it causes following error:

Check
{code}
ls jboss-eap-6.2.0.GA-maven-repository/org/slf4j

drwxrwxr-x. 3 testuser testuser 4096 Feb 18 16:37 jcl-over-slf4j
drwxrwxr-x. 3 testuser testuser 4096 Feb 18 16:37 slf4j-api
drwxrwxr-x. 3 testuser testuser 4096 Feb 18 16:37 slf4j-ext
drwxrwxr-x. 4 testuser testuser 4096 Feb 18 16:37 slf4j-jdk14
drwxrwxr-x. 3 testuser testuser 4096 Feb 18 16:37 slf4j-parent
{code}

${code}
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-antrun-plugin:1.7:run (generate-configs) on project jboss-as-build: Execution generate-configs of goal org.apache.maven.plugins:maven-antrun-plugin:1.7:run failed: Plugin org.apache.maven.plugins:maven-antrun-plugin:1.7 or one of its dependencies could not be resolved: Could not find artifact org.slf4j:slf4j-simple:jar:1.7.2.redhat-2
{code}



[1] http://download.eng.bos.redhat.com/brewroot/repos/jb-eap-6-rhel-6-build/latest/maven/org/slf4j/slf4j-simple/1.7.2.redhat-2/

Comment 4 Jay SenSharma 2014-02-18 12:06:13 UTC
For Missing "slf4j-simple" aritfact opened separate bugzilla 
https://bugzilla.redhat.com/show_bug.cgi?id=1066435

Comment 5 Peter Palaga 2016-07-07 11:25:39 UTC
I have just checked that the query

  find . -type f -name *.pom -exec grep "<url>http://download." {} \; -print 

does not return any Red Hat internal repositories for the following versions of Red Hat JBoss Enterprise Application Platform Maven Repository:

* 7.0.0
* 6.4.0
* 6.3.0
* 6.2.1

Note that the issue was reported for version 6.2.0, where I could reproduce it too.

Hence, the issue was fixed in "Red Hat JBoss Enterprise Application Platform 6.2 CP01 Incremental Maven Repository" released on 2014-02-13.


Note You need to log in before you can comment on or make changes to this bug.