rpkrajewski opened a new issue, #13050:
URL: https://github.com/apache/maven/issues/13050
### Affected version
3.9.10-rc1
### Bug description
Maven seems to fetch prefixes from repositories and tell you about it. Well,
apparently, it felt the need to process plugins (or dependencies?) mentioned in
the POM for the dependency-check plugin or one of _its_ dependencies:
```
[INFO] Loaded 23704 auto-discovered prefixes for remote repository central
(prefixes-central.txt)
[INFO] Loaded 74 auto-discovered prefixes for remote repository
apache.snapshots (prefixes-apache.snapshots.txt)
…
[INFO] --- dependency-check:13.0.0:check (default) @ apache-hc-filecached ---
[WARNING] Could not transfer metadata /.meta/prefixes.txt from/to
jvnet-nexus-releases (https://maven.java.net/content/repositories/releases/):
(certificate_unknown) PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target
```
The warning is correct: `maven.java.net` is using a self-signed certificate.
I don't think the warning is coming from code in `dependency-check`.
Is there any reason why Maven needs to process prefixes from a repository
that is likely mentioned in a pom deep in the dependencies?
I can't wait for consumer POMs to spread through the Maven ecosystem so that
this kind of historical cruft is no longer a distraction. 😀
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
