gnodet opened a new pull request, #13116: URL: https://github.com/apache/maven/pull/13116
## Problem After `03c947d8` (and its successor #13114 which sandboxes the activation context), profile repositories in dependency POMs are **always stripped** from active profiles, even when the profile activated legitimately via JDK version, OS, `activeByDefault`, or a POM-declared property. This breaks the established Maven pattern: ``` project → dep1 → dep2 ``` where `dep1` knows `dep2` is not on Central and declares its repository inside a JDK- or `activeByDefault`-activated profile. Discussed in #13100 (comment by @cstamas). ## Root cause The `withoutRepositories()` stripping (compat stack) and the `.map(profile → profile.withRepositories(…))` stripping (impl stack) are applied to **all** active profiles unconditionally, regardless of why they activated. But the sandbox activation context in #13114 already guarantees that only legitimate profiles survive to injection: | Activation kind | Activates in sandbox? | Repos contributed? | |---|---|---| | JDK / OS / `activeByDefault` | ✅ Yes | ✅ Honored (this PR) | | POM-declared `<property>` | ✅ Yes | ✅ Honored (this PR) | | Consumer `-D` flag | ❌ Suppressed by sandbox | ❌ Never reaches injection | | File condition | ❌ Pre-filtered | ❌ Never reaches injection | The stripping was therefore over-broad and broke legitimate use-cases with no security benefit (suppression already happens earlier in the sandbox). ## Solution Remove the repository stripping from both stacks for the `externalOrigin` / `VALIDATION_LEVEL_MINIMAL` branch: - **compat** (`maven-model-builder`): drop the `withoutRepositories()` call and the dead helper method from `DefaultModelBuilder` - **impl** (`maven-impl`): drop the `.map()` stripping from the `externalOrigin` branch of `getActiveProfiles()` The **BUILD\_CONSUMER** stripping (line 1755 in impl) is intentional and **unchanged** — consumer POMs must not leak profile repositories into the published artifact. ## Notes - Depends on / stacks on top of #13114 (the sandbox activation context). The sandbox is what makes this safe. - The redefinition concern raised by @cstamas (a dependency shadowing Central with a different URL) is orthogonal and should be addressed separately as a WARN/FAIL policy — not via blanket stripping. ## Changes - `DefaultModelBuilder` (compat): remove `withoutRepositories()` call and helper - `DefaultModelBuilder` (impl): remove `.map()` stripping from `externalOrigin` branch; update comment - `ExternalModelProfileActivationTest`: invert and rename the last test to assert the corrected behavior -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
