mvn install does not complete using the latest version of Maven 3.8, stalls requesting ctakes module

[JohnLevander]

Maven 3.8 added some extra security to block non-https resource downloads by default. On my Windows machine, this resulted in a never-ending wait for a jar from http://0.0.0.0/ when building the project. This occurs when trying to download a ctakes resource.

Screenshot:

I researched some fixes. The solutions are:

1. Ask user to downgrade to Maven 3.6 (not great)
2. Ask user to enter some security-reducing settings in the users settings.xml file (really not great)
3. track down the http (insecure) resources we are requesting and switch them to use https:// (preferred solution)

Regarding the last option, I looked through the poms and didn't find any calls to non-https resources but I will have to look again.

Here is a stack overflow thread on this issue:
https://stackoverflow.com/questions/66980047/maven-build-failure-dependencyresolutionexception

I tested Maven 3.3, 3.6. and 3.8. 3.8 is the release the build breaks.

[seanfinan]

This is not good.
#3 (switch to https) is not an option. We do not control the actual repos for any of the dependencies. I can look into this further, but considering the number of different providers this is really problematic.
#2 (user change settings.xml) is not really great. As soon as you ask users to go edit files they tune out.
#1 is the best option. It is easier for the user than #2 and it is tried and tested by many users over many years.

[tmills]

what about this option?
https://stackoverflow.com/a/67441519
Essentially creating a custom settings.xml for the project. I assume it uses the settings you provide and backs off to the global settings for anything you leave out, so you could just put in mirrors for the repos without https?

[seanfinan]

That sounds good. Another problem might occur if they have settings in their regular settings.xml that allow tunneling through a firewall or something like that. I have something special in mine. However, I think that chances of that kind of problem are low and we could handle special cases separately - maybe a comment at the bottom of a readme or something with an indication of what we are doing.

[seanfinan]

Ok, some strange stuff:

1. In the dphe poms we specifically point to https for ctakes:
   https://repository.apache.org/content/groups/snapshots/
2. Supposedly, Sonatype, the biggest maven central provider, is completely https, not http.
   https://blog.sonatype.com/central-repository-moving-to-https

[seanfinan]

And ... right now I am building with maven 3.8.2 and no errors, http or otherwise.

[JohnLevander]

Hmmm I was on a clean machine…did you clear your .m2 directory? I assume you did but just checking.

…

On Sep 30, 2021, at 5:05 PM, seanfinan ***@***.***> wrote:  And ... right now I am building with maven 3.8.2 and no errors, http or otherwise. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.

[seanfinan]

I did clear .m2 of everything under ctakes. It took a long time to grab the jars but it did get them - from the https area.
Did you see it fail or did you just see those warnings? When clean, that mirror will attempt to use http for externals. Why it tries that first is beyond me. However, after that fails it will go through an https and get the poms and jars.

[JohnLevander]

I let the process run for and hour just to see if it would complete. Then I killed it. I’ll investigate more tomorrow.

…

On Sep 30, 2021, at 6:38 PM, seanfinan ***@***.***> wrote:  I did clear .m2 of everything under ctakes. It took a long time to grab the jars but it did get them - from the https area. Did you see it fail or did you just see those warnings? When clean, that mirror will attempt to use http for externals. Why it tries that first is beyond me. However, after that fails it will go through an https and get the poms and jars. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.

[JohnLevander]

So I let it run all night and the process never finished with v3.8.1., I set MAVEN_HOME back to v3.8.2 and seems like I'm getting the same issue. Versions 3.3 and 3.6 work, strangely, on the same machine. That was all on my Windows machine.

I just verified that 3.8.2 builds just fine on the Mac.

I'm going to close this and reopen it if there is something we need to do or if it's just a "lucky" machine configuration that I stumbled upon.