How to secure maven against code injection

Hello, Maven dependency management can be a security breach if naively implemented by enabling injection of 3rd party code into your application that get deployed in production. So, I came up with some defensive approach and I would like people to review them from their experience and maybe

RE: convincing Workplace to use Maven

Depending on which technology stack you are using you may have hard time to sell this migration, especially if you're building J2EE apps mixing EJBs and webapps deployed on a commercial platform. Make sure you don't propose only a tool (maven) but rather a full development environment with a

RE: Why Maven is Hard?

This book rocks especially the chapter 15 on j2ee. After spending weeks trying to build similar simple project in maven, it's great to find this, thanks. Now, I'll try to convert this from Geronimo to WebLogic, in case of success I'll share. -- Gael -Original Message- From: Brian E.

RE: Why Maven is Hard?

I have exactly the same experience and feelings. Maven's philosophy is what motivates you to use it and then as soon as you start working on non trivial enterprise projects you find yourself spending most of your time on implementing workarounds for plugins that are poorly documented, not

RE: Why Maven is Hard?

Another thing that is hard in Maven is solving classpath issues. Classpath issues can be hard to solve in java but in Maven it is even harder because your plugin inherits from a classpath built by maven from your dependencies and others as well. So when something fails, you must understand who

RE: Why Maven is Hard?

I also think that Maven is hard because it has not been endorsed by large vendors like BEA. BEA WebLogic comes with a set of ant tasks and conventions like the split directory project structure. There is a WebLogic plugin on codehaus that encapsulates these ant tasks but using it is difficult

RE: maven proxies

We use artifactory mainly because it's so simple to install and setup. Gael -Original Message- From: maarten roosendaal [mailto:[EMAIL PROTECTED] Sent: Saturday, June 30, 2007 9:24 AM To: Maven Users List Subject: Re: maven proxies Brett, We are in the progress of moving to

RE: Image resizing in site-build

Why don't you do it in your plugin? -Original Message- From: Roland Asmann [mailto:[EMAIL PROTECTED] Sent: Friday, June 29, 2007 6:55 PM To: Maven Users List Subject: Image resizing in site-build Hi all! I was wondering if there is a possibility to have Maven resize the

Migration from WebLogic split directory to Maven

Hello, Has anyone gone through migrating an EJB project using WebLogic's split directory structure to Maven? I'd like to get some hands-on experience feedback on: - how you split into sub modules (appUtil, ...) - whether you used maven ejb plugin (seems outdated for WL 9.2) or kept using WL ant

Which version for testng 5.5?

Hello, I saw that surefire-testng 2.3 depends on testng 5.1, I tried testng 5.5 and it fails. Which version of surefire will be compatible with 5.5? Thanks, Gael

RE: Null registry

- create ~/.m2/archiva.xml with a configuration/ element I already tried this, it did not work. - use the plexus appserver - use jetty:run I don't have time to learn another app server and also I want it to be started as a windows service. Anyway, I think that I'm not ready for Archiva or

RE: Null registry

Yes it looks the same I got. -Original Message- From: Henri Yandell [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 14, 2007 4:58 PM To: archiva-users@maven.apache.org Subject: Re: Null registry If the error you get is: java.lang.NullPointerException

RE: Any Archiva download soon?

Thanks a lot Wendy. With your updated instructions, I was able to start Archiva and login. However, I get an NPE due to a null registry (don't know what it means) when trying to add a managed repository. Thanks, Gael 2007-03-13 11:28:35,355 [Thread-1] INFO PlexusContainer - Loading on start

RE: Any Archiva download soon?

: Any Archiva download soon? On 3/13/07, Marziou, Gael [EMAIL PROTECTED] wrote: Thanks a lot Wendy. With your updated instructions, I was able to start Archiva and login. However, I get an NPE due to a null registry (don't know what it means) when trying to add a managed repository

Null registry

I am new at Archiva. I have built it from the latest from svn, deployed it on Tomcat 5.5.23 on windows 2000. Now I get an NPE (for a null registry, see attached log) when I try to add a repository, I originally posted on maven users mailing list where Wendy Smoak kindly told me it could be due to

RE: Any Archiva download soon?

Thanks Thomas, it did work. I have generated the war file and deployed it on Tomcat 5.5.23 using the procedure in: http://maven.apache.org/archiva/guides/getting-started/index.html It failed with the error below. Thanks, Gael 2007-03-12 18:17:47,125 [Thread-1] INFO PlexusContainer

Any Archiva download soon?

Hello, I have tried several times to build Archiva from sources but each time, I am unable to resolve all dependencies so I have given up. How far is the Archiva project from releasing a binary build? Thanks, Gael - To

RE: Any Archiva download soon?

Thanks Olivier, I tried but it failed also. Gael mvn -P apache-snapshots -Dmaven.test.skip=true install . GroupId: org.slf4j ArtifactId: slf4j-parent Version: 1.0-SNAPSHOT Reason: Unable to download the artifact from any repository org.slf4j:slf4j-parent:pom:1.0-SNAPSHOT from the