Adds sbt.repository.secure (default: true) #1494

ivy/src/main/scala/sbt/Resolver.scala

@@ -135,7 +135,7 @@ final case class SftpRepository(name: String, connection: SshConnection, pattern
 
 import Resolver._
 
-object DefaultMavenRepository extends MavenRepository("public", DefaultMavenRepositoryRoot)
+object DefaultMavenRepository extends MavenRepository("public", centralRepositoryRoot(useSecureResolvers))
 object JavaNet2Repository extends MavenRepository(JavaNet2RepositoryName, JavaNet2RepositoryRoot)
 object JCenterRepository extends MavenRepository(JCenterRepositoryName, JCenterRepositoryRoot)
 object JavaNet1Repository extends JavaNet1Repository
@@ -144,6 +144,8 @@ sealed trait JavaNet1Repository extends Resolver {
 }
 
 object Resolver {
+  private[sbt] def useSecureResolvers = sys.props.get("sbt.repository.secure") map { _.toLowerCase == "true" } getOrElse true
+
   val TypesafeRepositoryRoot = "http://repo.typesafe.com/typesafe"
   val SbtPluginRepositoryRoot = "http://repo.scala-sbt.org/scalasbt"
   val SonatypeRepositoryRoot = "https://oss.sonatype.org/content/repositories"
@@ -152,6 +154,7 @@ object Resolver {
   val JCenterRepositoryName = "jcenter"
   val JCenterRepositoryRoot = "https://jcenter.bintray.com/"
   val DefaultMavenRepositoryRoot = "https://repo1.maven.org/maven2/"
+  private[sbt] def centralRepositoryRoot(secure: Boolean) = (if (secure) "https" else "http") + "://repo1.maven.org/maven2/"
 
   // obsolete: kept only for launcher compatibility
   private[sbt] val ScalaToolsReleasesName = "Sonatype OSS Releases"

notes/0.13.6.md

@@ -42,6 +42,7 @@
   [1487]: https://github.com/sbt/sbt/pull/1487
   [1488]: https://github.com/sbt/sbt/pull/1488
   [1489]: https://github.com/sbt/sbt/pull/1489
+  [1494]: https://github.com/sbt/sbt/pull/1494
 
   [@dansanduleac]: https://github.com/dansanduleac
   [@2m]: https://github.com/2m
@@ -57,6 +58,7 @@
   [@dpratt]: https://github.com/dpratt
   [@henrikengstrom]: https://github.com/henrikengstrom
   [@puffnfresh]: https://github.com/puffnfresh
+  [@rtyley]: https://github.com/rtyley
 
 ### Changes since 0.13.6-M1
 
@@ -64,6 +66,7 @@
 
 ### Fixes with compatibility implications
 
+- Maven Central Repository now defaults to HTTPS. [#1494][1494] by [@rtyley][@rtyley]
 - `ThisProject` used to resolve to the root project in a build even when it's place in `subproj/build.sbt`. sbt 0.13.6 fixes it to resolve to the sub project. [#1194][1194]/[#1358][1358] by [@dansanduleac][@dansanduleac]
 - Global plugins classpath used to be injected into every build. This will no longer be the case. [#1347][1347]/[#1352][1352] by [@dansanduleac][@dansanduleac]
 - Fixes `newer` command in scripted. [#1419][1419] by [@jroper][@jroper]
@@ -99,6 +102,14 @@
 - Fixes `Scope.parseScopedKey`. [#1384][1384] by [@eed3si9n][@eed3si9n]
 - Fixes `build.sbt` errors causing `ArrayIndexOutOfBoundsException` due to invalid source in position. [#1181][1181] by [@eed3si9n][@eed3si9n]
 
+### Maven Central Repository defaults to HTTPS
+
+Thanks to Sonatype, HTTPS access to Maven Central Repository is available to public. This is now enabled by default, but if HTTP is required for some reason the following system properties can be used:
+
+    -Dsbt.repository.secure=false
+
+[#1494][1494] by [@rtyley][@rtyley]
+
 ### enablePlugins/disablePlugins
 
 sbt 0.13.6 now allows `enablePlugins` and `disablePlugins` to be written directly in `build.sbt`. [#1213][1213]/[#1312][1312] by [@jsuereth][@jsuereth]