[
https://issues.apache.org/jira/browse/CXF-8913?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18073759#comment-18073759
]
Colm O hEigeartaigh commented on CXF-8913:
------------------------------------------
Hi [~davsclaus] ,
Sorry for the delay in replying. Are you still seeing build failures? It was
done earlier today but seems to be back up. We recently merged a PR to change
the URL [https://github.com/apache/ws-wss4j/pull/593]
I will revisit the work done last year to make opensaml optional. It was at
quite an advanced stage in WSS4J itself but needs some work in CXF then. If
that doesn't pan out I'll look at the bundle approach.
Colm.
> Avoid 3rd party maven repository for OpenSAML
> ---------------------------------------------
>
> Key: CXF-8913
> URL: https://issues.apache.org/jira/browse/CXF-8913
> Project: CXF
> Issue Type: Improvement
> Components: WS-* Components
> Affects Versions: 4.0.2
> Reporter: Claus Ibsen
> Assignee: Colm O hEigeartaigh
> Priority: Major
>
> Apache CXF depends on OpenSAML from Apache WSSJ project
> However this commit causes wss4j to download JARs from NOT maven central but
> from
> https://build.shibboleth.net/nexus/content/groups/public
> https://github.com/apache/ws-wss4j/commit/e4a33efcb2b474a1da2b2c08f815b2718e111823
> Is there a way for Apache CXF to only use JARs from maven central. There is a
> trust issue when JARs are NOT downloaded from central.
> At Apache Camel we only download from maven central - except for camel-jira
> which sadly had to download from Atlassian. We are considering deprecating
> and removing this component for that reason.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
