rmannibucau commented on PR #995:
URL: https://github.com/apache/maven/pull/995#issuecomment-5679757470
I still have a hard time to see how it helps more than creating false
positive in the environments it should help (enterprises with proxies and
mounted volumes):
1.
> new DefaultArtifact("org.apache.maven", "apache-maven", null, "pom",
"3.8.6")
not sure we should hardcode this artifact, there is no guarantee this will
not be blacklisted in mirrors/proxies at some point, ultimately using the
_current contextual_ version is the least worse
it is also a random test which is known as giving false positive so not sure
it is that worth, a plain "socket" (respecting proxies) test is generally more
valuable in enterprises until you are sure you hit the real central
note: this is also true for connection verifier which issues a get task on /
which is not always allowed - ultimately any 4xx should be considered as valid
but it also means you don't know if the proxy or backend failed so not very
helpful
2.
> verifyLocalRepository
think this one doesn't validate much - it is not uncommon to not have perms
on a sub folder and it is unlikely we do validate it recursively, so maybe just
harnessing the presence is sufficient
more on the code style:
3.
> cleanupTempFiles()
if kept it must be in a finally block and likely a shutdown hook removal
(add and removed once executed) to not leak temp files _as usual_
so overall I still think a small fatjar which can be downloaded aside maven
(in maveniverse or alike) can be valuable for your case but in core maven it
sounds like buggy by design or not reaching its goal from what I experienced
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
