CycloneDX / CycloneDX/cyclonedx-maven-plugin
Plugin does not use repositories specified in the project's pom
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 385
- Forks
- 108
- Avg merge
- 17h 31m
- Merged PRs (30d)
- 7
Description
The plugin fails to load jars from 3rd party repositories, even if they are defined in the pom. It prints out warnings such as:
> [WARNING] Unable to create Maven project for org.geotools:gt-referencing:jar:28.2 from repository.
This particular jar comes from `https://repo.osgeo.org/repository/release`.
As a work-around, the plugin is able to resolve repositories if they are defined in a profile in `~/.m2/settings.xml`, but this makes the project non-portable. The project can also be built with a bundled `settings.xml` (e.g. `mvn -s cyclonedx-settings.xml`), but then any user configuration in the default `~/.m2/settings.xml` is not picked up.
As an example, see https://github.com/elahrvivaz/geomesa/tree/2058f9222c964c38ca96a9de4d77cda8eb3ea11f
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the warning with the example GeoMesa project and inspect how the plugin reads the project's pom versus ~/.m2/settings.xml. Verify the behavior with a repository declared in the pom and with user settings present. Done means third-party jars resolve from repositories declared in the pom while existing user Maven configuration remains available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100