How to disable maven blocking external HTTP repositores?

Solution 1:

I found a solution to do this by inspecting the commit in the Maven git repository that is responsible for the default HTTP blocking: https://github.com/apache/maven/commit/907d53ad3264718f66ff15e1363d76b07dd0c05f

My solution is as follows:

In the Maven settings (located in ${maven.home}/conf/settings.xml or ${user.home}/.m2/settings.xml), the following entry must be removed:

<mirror>
  <id>maven-default-http-blocker</id>
  <mirrorOf>external:http:*</mirrorOf>
  <name>Pseudo repository to mirror external repositories initially using HTTP.</name>
  <url>http://0.0.0.0/</url>
</mirror>

If you work in a project and cannot make sure the Maven settings are always like that, e.g. because you share code with other people or want to use CI/CD with automated testing, you may do the following: Add a directory named .mvn in the project. In the .mvn directory, add a file named maven.config with the content --settings ./.mvn/local-settings.xml. In the .mvn directory, add a file named local-settings.xml. This file should look like this:

<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 http://maven.apache.org/xsd/settings-1.2.0.xsd">
    <mirrors>
        <mirror>
            <id>my-repository-http-unblocker</id>
            <mirrorOf>my-blocked-http-repository</mirrorOf>
            <name></name>
            <url>http://........</url>
        </mirror>
    </mirrors>
</settings>

Where inside the <mirrorOf> tag, you need to specify the id of the blocked repository, and in the <url> tag, you specify the original url of the repository again. You need to create this unblocker mirror for every repository you have that is blocked.

Example:

If you have the following HTTP repositories defined in the pom.xml:

<repositories>
    <repository>
        <snapshots>
            <enabled>false</enabled>
        </snapshots>
        <id>central</id>
        <name>libs-release</name>
        <url>http://my-url/libs-release</url>
    </repository>
    <repository>
        <id>snapshots</id>
        <name>libs-snapshot</name>
        <url>http://my-url/libs-snapshot</url>
    </repository>
</repositories>

Then you need in the .mvn/local-settings.xml:

<mirrors>
    <mirror>
        <id>release-http-unblocker</id>
        <mirrorOf>central</mirrorOf>
        <name></name>
        <url>http://my-url/libs-release</url>
    </mirror>
    <mirror>
        <id>snapshot-http-unblocker</id>
        <mirrorOf>snapshots</mirrorOf>
        <name></name>
        <url>http://my-url/libs-snapshot</url>
    </mirror>
</mirrors>

I hope my work can help other people who stumble upon this. However, if you have a more elegant or better solution, please share!

Solution 2:

In my case, I just added a dummy mirror with the id maven-default-http-blocker to override the existing one. This disable HTTP blocking for all repositories.

<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 http://maven.apache.org/xsd/settings-1.2.0.xsd">
     <mirrors>
          <mirror>
               <id>maven-default-http-blocker</id>
               <mirrorOf>dummy</mirrorOf>
               <name>Dummy mirror to override default blocking mirror that blocks http</name>
               <url>http://0.0.0.0/</url>
         </mirror>
    </mirrors>
</settings>

Solution 3:

Another possible solution/workaround is to override the new default http-blocking behavior by commenting out the maven-default-http-blocker mirror in the <mirrors> section of the maven's 'main' settings.xml file (under /opt/maven/conf in my case);

<!--mirror>
  <id>maven-default-http-blocker</id>
  <mirrorOf>external:http:*</mirrorOf>
  <name>Pseudo repository to mirror external repositories initially using HTTP.</name>
  <url>http://0.0.0.0/</url>
  <blocked>false</blocked>
</mirror-->

P.S. Whether it's a good idea to unblock all insecure http repositories is a whole other story.

Solution 4:

You should just add a mirror to your http repository that allows http in your maven settings. You shouldn't eliminate the default maven behavior for all repositories. Then tell your devops team to use https!

in .m2/settings.xml:

<mirrors>
        <mirror>
            <id>my-repo-mirror</id>
            <name>My Repo HTTP Mirror</name>
            <url>http://url-to.my/repo</url>
            <mirrorOf>my-repo</mirrorOf>
        </mirror>
</mirrors>

Solution 5:

In macOS Monterey, and using Intellij Ultimate 2021.3 (and up), with maven NOT INSTALLED in the system and using maven as a plugin inside Intellij, i found the "settings.xml" file in the path:

${user.home}/Library/Application Support/JetBrains/Toolbox/apps/IDEA-U/ch-0/213.5744.223/IntelliJ IDEA.app/Contents/plugins/maven/lib/maven3/conf/settings.xml

Note: the above path is when the Intellij is installed using the Jetbrains Toolbox App, and the version number indicated (213.5744.223) can defer if you have another version, verify when travelling the path to the file.

Open the "settings.xml" file with your favourite editor, and comment the next lines:

<!--<mirror>
  <id>maven-default-http-blocker</id>
  <mirrorOf>external:http:*</mirrorOf>
  <name>Pseudo repository to mirror external repositories initially using HTTP.</name>
  <url>http://0.0.0.0/</url>
  <blocked>true</blocked>
</mirror>-->

Hope it helped.