Merge pull request #5593 from eed3si9n/wip/http

Remove HTTP support without explicit opt-in

build.sbt

@@ -951,7 +951,9 @@ lazy val mainProj = (project in file("main"))
       // since we're returning the same values as before.
       exclude[IncompatibleSignatureProblem]("sbt.Classpaths.mkIvyConfiguration"),
       exclude[IncompatibleMethTypeProblem]("sbt.internal.server.Definition*"),
-      exclude[IncompatibleTemplateDefProblem]("sbt.internal.server.LanguageServerProtocol")
+      exclude[IncompatibleTemplateDefProblem]("sbt.internal.server.LanguageServerProtocol"),
+      exclude[DirectMissingMethodProblem]("sbt.Classpaths.warnInsecureProtocol"),
+      exclude[DirectMissingMethodProblem]("sbt.Classpaths.warnInsecureProtocolInModules"),
     )
   )
   .configure(

main/src/main/scala/sbt/Defaults.scala

@@ -2748,12 +2748,19 @@ object Classpaths {
     }
   }
 
-  private[sbt] def warnInsecureProtocol(ress: Seq[Resolver], log: Logger): Unit = {
-    ress.foreach(_.validateProtocol(log))
+  private[sbt] def errorInsecureProtocol(ress: Seq[Resolver], log: Logger): Unit = {
+    val bad = !ress.forall(!_.validateProtocol(log))
+    if (bad) {
+      sys.error("insecure protocol is unsupported")
+    }
   }
   // this warns about .from("http:/...") in ModuleID
-  private[sbt] def warnInsecureProtocolInModules(mods: Seq[ModuleID], log: Logger): Unit = {
-    mods.foreach(_.validateProtocol(log))
+  private[sbt] def errorInsecureProtocolInModules(mods: Seq[ModuleID], log: Logger): Unit = {
+    val artifacts = mods.flatMap(_.explicitArtifacts.toSeq)
+    val bad = !artifacts.forall(!_.validateProtocol(log))
+    if (bad) {
+      sys.error("insecure protocol is unsupported")
+    }
   }
 
   private[sbt] def defaultProjectID: Initialize[ModuleID] = Def.setting {
@@ -2782,7 +2789,7 @@ object Classpaths {
     }
   def moduleSettings0: Initialize[Task[ModuleSettings]] = Def.task {
     val deps = allDependencies.value.toVector
-    warnInsecureProtocolInModules(deps, streams.value.log)
+    errorInsecureProtocolInModules(deps, streams.value.log)
     ModuleDescriptorConfiguration(projectID.value, projectInfo.value)
       .withValidate(ivyValidate.value)
       .withScalaModuleInfo(scalaModuleInfo.value)
@@ -3413,7 +3420,7 @@ object Classpaths {
       val (rs, other) = (fullResolvers.value.toVector, otherResolvers.value.toVector)
       val s = streams.value
       warnResolversConflict(rs ++: other, s.log)
-      warnInsecureProtocol(rs ++: other, s.log)
+      errorInsecureProtocol(rs ++: other, s.log)
       InlineIvyConfiguration()
         .withPaths(ivyPaths.value)
         .withResolvers(rs)

main/src/main/scala/sbt/coursierint/LMCoursier.scala

@@ -91,7 +91,7 @@ object LMCoursier {
     val sbtScalaOrganization = "org.scala-lang" // always assuming sbt uses mainline scala
     val userForceVersions = Inputs.forceVersions(depsOverrides, scalaVer, scalaBinaryVer)
     Classpaths.warnResolversConflict(rs, log)
-    Classpaths.warnInsecureProtocol(rs, log)
+    Classpaths.errorInsecureProtocol(rs, log)
     CoursierConfiguration()
       .withResolvers(rs.toVector)
       .withInterProjectDependencies(interProjectDependencies.toVector)

project/Dependencies.scala

@@ -13,7 +13,7 @@ object Dependencies {
   // sbt modules
   private val ioVersion = nightlyVersion.getOrElse("1.4.0-M6")
   private val lmVersion =
-    sys.props.get("sbt.build.lm.version").orElse(nightlyVersion).getOrElse("1.3.0")
+    sys.props.get("sbt.build.lm.version").orElse(nightlyVersion).getOrElse("1.4.0-M1")
   val zincVersion = nightlyVersion.getOrElse("1.4.0-M5")
 
   private val sbtIO = "org.scala-sbt" %% "io" % ioVersion

sbt/src/sbt-test/dependency-management/default-resolvers/test

@@ -9,3 +9,7 @@
 > set resolvers += Resolver.jcenterRepo
 
 > check2
+
+## HTTP
+> set resolvers += ("old_typesafe" at "http://repo.typesafe.com/typesafe/")
+-> update

sbt/src/sbt-test/dependency-management/exclude-bundle/build.sbt

@@ -1,3 +1,3 @@
 libraryDependencies += "org.vaadin" % "dontpush-addon-ozonelayer" % "0.4.6"
 
-resolvers += "asdf" at "http://maven.vaadin.com/vaadin-addons"
+resolvers += "asdf" at "https://maven.vaadin.com/vaadin-addons"

sbt/src/sbt-test/dependency-management/exclude-bundle/changes/build.sbt

@@ -1,3 +1,3 @@
 libraryDependencies += "org.vaadin" % "dontpush-addon-ozonelayer" % "0.4.6" exclude("org.atmosphere", "atmosphere-compat-jetty")
 
-resolvers += "asdf" at "http://maven.vaadin.com/vaadin-addons"
+resolvers += "asdf" at "https://maven.vaadin.com/vaadin-addons"

sbt/src/sbt-test/dependency-management/url/build.sbt

@@ -3,7 +3,7 @@ import sbt.internal.inc.classpath.ClasspathUtilities
 lazy val root = (project in file(".")).
   settings(
     ivyPaths := IvyPaths(baseDirectory.value, Some(target.value / "ivy-cache")),
-    libraryDependencies += "org.jsoup" % "jsoup" % "1.9.1" % Test from "http://jsoup.org/packages/jsoup-1.9.1.jar",
+    libraryDependencies += "org.jsoup" % "jsoup" % "1.9.1" % Test from "https://jsoup.org/packages/jsoup-1.9.1.jar",
     ivyLoggingLevel := UpdateLogging.Full,
     TaskKey[Unit]("checkInTest") := checkClasspath(Test).value,
     TaskKey[Unit]("checkInCompile") := checkClasspath(Compile).value