Merge pull request #1507 from sbt/wip/optional-https-maven-central

"Use HTTPS for downloading artifacts from Maven Central" + disable flag

ivy/src/main/scala/sbt/MakePom.scala

@@ -307,7 +307,7 @@ class MakePom(val log: Logger) {
       val repositories = if (includeAll) allResolvers(settings) else resolvers(settings.getDefaultResolver)
       val mavenRepositories =
         repositories.flatMap {
-          case m: IBiblioResolver if m.isM2compatible && m.getRoot != IBiblioResolver.DEFAULT_M2_ROOT =>
+          case m: IBiblioResolver if m.isM2compatible && m.getRoot != DefaultMavenRepository.root =>
             MavenRepository(m.getName, m.getRoot) :: Nil
           case _ => Nil
         }

ivy/src/main/scala/sbt/Resolver.scala

@@ -6,7 +6,7 @@ package sbt
 import java.io.File
 import java.net.URL
 import scala.xml.NodeSeq
-import org.apache.ivy.plugins.resolver.{ DependencyResolver, IBiblioResolver }
+import org.apache.ivy.plugins.resolver.DependencyResolver
 
 sealed trait Resolver {
   def name: String
@@ -135,7 +135,7 @@ final case class SftpRepository(name: String, connection: SshConnection, pattern
 
 import Resolver._
 
-object DefaultMavenRepository extends MavenRepository("public", IBiblioResolver.DEFAULT_M2_ROOT)
+object DefaultMavenRepository extends MavenRepository("public", centralRepositoryRoot(useSecureResolvers))
 object JavaNet2Repository extends MavenRepository(JavaNet2RepositoryName, JavaNet2RepositoryRoot)
 object JCenterRepository extends MavenRepository(JCenterRepositoryName, JCenterRepositoryRoot)
 object JavaNet1Repository extends JavaNet1Repository
@@ -144,6 +144,8 @@ sealed trait JavaNet1Repository extends Resolver {
 }
 
 object Resolver {
+  private[sbt] def useSecureResolvers = sys.props.get("sbt.repository.secure") map { _.toLowerCase == "true" } getOrElse true
+
   val TypesafeRepositoryRoot = "http://repo.typesafe.com/typesafe"
   val SbtPluginRepositoryRoot = "http://repo.scala-sbt.org/scalasbt"
   val SonatypeRepositoryRoot = "https://oss.sonatype.org/content/repositories"
@@ -151,6 +153,8 @@ object Resolver {
   val JavaNet2RepositoryRoot = "http://download.java.net/maven/2"
   val JCenterRepositoryName = "jcenter"
   val JCenterRepositoryRoot = "https://jcenter.bintray.com/"
+  val DefaultMavenRepositoryRoot = "https://repo1.maven.org/maven2/"
+  private[sbt] def centralRepositoryRoot(secure: Boolean) = (if (secure) "https" else "http") + "://repo1.maven.org/maven2/"
 
   // obsolete: kept only for launcher compatibility
   private[sbt] val ScalaToolsReleasesName = "Sonatype OSS Releases"

launch/src/test/scala/ConfigurationParserTest.scala

@@ -21,64 +21,64 @@ object ConfigurationParserTest extends Specification {
         Repository.Predefined("local", false))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org""".stripMargin,
+                                            |  id: https://repo1.maven.org""".stripMargin,
-        Repository.Maven("id", new URL("http://repo1.maven.org"), false))
+        Repository.Maven("id", new URL("https://repo1.maven.org"), false))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, bootOnly""".stripMargin,
+                                            |  id: https://repo1.maven.org, bootOnly""".stripMargin,
-        Repository.Maven("id", new URL("http://repo1.maven.org"), true))
+        Repository.Maven("id", new URL("https://repo1.maven.org"), true))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath]""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath]""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[orgPath]", false, false))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[orgPath]", false, false))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], mavenCompatible""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], mavenCompatible""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[orgPath]", true, false))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[orgPath]", true, false))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], mavenCompatible, bootOnly""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], mavenCompatible, bootOnly""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[orgPath]", true, true))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[orgPath]", true, true))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], bootOnly, mavenCompatible""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], bootOnly, mavenCompatible""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[orgPath]", true, true))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[orgPath]", true, true))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], bootOnly""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], bootOnly""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[orgPath]", false, true))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[orgPath]", false, true))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], [artPath]""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], [artPath]""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[artPath]", false, false))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[artPath]", false, false))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], [artPath], descriptorOptional""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], [artPath], descriptorOptional""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[artPath]", false, false, true, false))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[artPath]", false, false, true, false))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], [artPath], descriptorOptional, skipConsistencyCheck""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], [artPath], descriptorOptional, skipConsistencyCheck""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[artPath]", false, false, true, true))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[artPath]", false, false, true, true))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], [artPath], skipConsistencyCheck, descriptorOptional""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], [artPath], skipConsistencyCheck, descriptorOptional""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[artPath]", false, false, true, true))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[artPath]", false, false, true, true))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], [artPath], skipConsistencyCheck, descriptorOptional, mavenCompatible, bootOnly""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], [artPath], skipConsistencyCheck, descriptorOptional, mavenCompatible, bootOnly""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[artPath]", true, true, true, true))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[artPath]", true, true, true, true))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], [artPath], bootOnly""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], [artPath], bootOnly""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[artPath]", false, true))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[artPath]", false, true))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], [artPath], bootOnly, mavenCompatible""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], [artPath], bootOnly, mavenCompatible""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[artPath]", true, true))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[artPath]", true, true))
 
       repoFileContains("""|[repositories]
-                                            |  id: http://repo1.maven.org, [orgPath], [artPath], mavenCompatible, bootOnly""".stripMargin,
+                                            |  id: https://repo1.maven.org, [orgPath], [artPath], mavenCompatible, bootOnly""".stripMargin,
-        Repository.Ivy("id", new URL("http://repo1.maven.org"), "[orgPath]", "[artPath]", true, true))
+        Repository.Ivy("id", new URL("https://repo1.maven.org"), "[orgPath]", "[artPath]", true, true))
 
     }
   }

notes/0.13.6.md

@@ -42,6 +42,7 @@
   [1487]: https://github.com/sbt/sbt/pull/1487
   [1488]: https://github.com/sbt/sbt/pull/1488
   [1489]: https://github.com/sbt/sbt/pull/1489
+  [1494]: https://github.com/sbt/sbt/pull/1494
 
   [@dansanduleac]: https://github.com/dansanduleac
   [@2m]: https://github.com/2m
@@ -57,6 +58,7 @@
   [@dpratt]: https://github.com/dpratt
   [@henrikengstrom]: https://github.com/henrikengstrom
   [@puffnfresh]: https://github.com/puffnfresh
+  [@rtyley]: https://github.com/rtyley
 
 ### Changes since 0.13.6-M1
 
@@ -64,6 +66,7 @@
 
 ### Fixes with compatibility implications
 
+- Maven Central Repository now defaults to HTTPS. [#1494][1494] by [@rtyley][@rtyley]
 - `ThisProject` used to resolve to the root project in a build even when it's place in `subproj/build.sbt`. sbt 0.13.6 fixes it to resolve to the sub project. [#1194][1194]/[#1358][1358] by [@dansanduleac][@dansanduleac]
 - Global plugins classpath used to be injected into every build. This will no longer be the case. [#1347][1347]/[#1352][1352] by [@dansanduleac][@dansanduleac]
 - Fixes `newer` command in scripted. [#1419][1419] by [@jroper][@jroper]
@@ -99,6 +102,14 @@
 - Fixes `Scope.parseScopedKey`. [#1384][1384] by [@eed3si9n][@eed3si9n]
 - Fixes `build.sbt` errors causing `ArrayIndexOutOfBoundsException` due to invalid source in position. [#1181][1181] by [@eed3si9n][@eed3si9n]
 
+### Maven Central Repository defaults to HTTPS
+
+Thanks to Sonatype, HTTPS access to Maven Central Repository is available to public. This is now enabled by default, but if HTTP is required for some reason the following system properties can be used:
+
+    -Dsbt.repository.secure=false
+
+[#1494][1494] by [@rtyley][@rtyley]
+
 ### enablePlugins/disablePlugins
 
 sbt 0.13.6 now allows `enablePlugins` and `disablePlugins` to be written directly in `build.sbt`. [#1213][1213]/[#1312][1312] by [@jsuereth][@jsuereth]

project/Docs.scala

@@ -27,7 +27,6 @@ object Docs {
     GitKeys.gitBranch in ghkeys.updatedRepository := Some("master")
   )
 
-
   def localRepoDirectory = ghkeys.repository := {
     // distinguish between building to update the site or not so that CI jobs 
     //  that don't commit+publish don't leave uncommitted changes in the working directory