bamaer opened a new issue, #8393:
URL: https://github.com/apache/hop/issues/8393
### What needs to happen?
A project's `hop-env.yaml` can declare its own plugin repository. When the
declaration omits a username or password, `EnvironmentApplier` fills them in
from the globally configured repository
(`EnvironmentApplier.java:241-246`):
StringUtils.isNotBlank(ref.getUsername()) ? ref.getUsername() :
baseRepo.getUsername(),
StringUtils.isNotBlank(ref.getPassword()) ? ref.getPassword() :
baseRepo.getPassword()
The URL on line 240 comes from the project. So enabling a project that names
a
repository the operator has never configured sends the operator's stored
repository credentials to it.
Only reuse the configured credentials when the project's URL points at the
same
repository they belong to — compare scheme, host and port against
`baseRepo.normalizedUrl()` (`MarketplaceRepository.java:209`). Otherwise use
only
what the project declared, or none.
## Scope
This covers the credentials. It does not stop a project pointing the plugin
supply chain at a repository of its choosing — that needs operator
confirmation
before a project may introduce a repository that is not already configured,
which
has its own design question for headless runs (hop-run, CI) and is better
handled
separately.
## Compatibility
Projects that legitimately reference a second path on the same repository
host
keep working. A project referencing a different host must now carry its own
credentials, which is the intended behaviour; today it silently borrows them.
### Issue Priority
Priority: 2
### Issue Component
Component: Marketplace
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
