Credential scoping + relocation validation (3.9.x backport) - #13005
Merged
Conversation
Credentials configured in settings for a server id are keyed only by that id. A repository definition can also arrive from a POM resolved out of a remote repository and reuse the id of a server the operator holds credentials for, at a different origin than the one the operator configured. Wrap the authentication selector so credentials for an id are offered only to a repository whose origin (scheme, host, port) matches a repository or mirror the operator declared, in settings or on the command line, with that same id; other origins get a once-per-id/origin warning naming the id and are refused. Ids with no operator-declared repository (for example a deploy-only server whose URL comes from the project's distributionManagement) keep serving credentials as before, with a warning, so mvn deploy using settings credentials plus a POM's distributionManagement keeps working. The new maven.repository.credentialScope user property selects the policy: "origin" (default), "strict" (also refuse undeclared ids), or legacy "id".
Aligns the legacy WagonManager credential lookup with the exact-match semantics used by every other id-keyed credential path; server ids have never been documented as case-insensitive.
gnodet
force-pushed
the
pr/core-and-compat-3.9.x
branch
from
September 1, 2026 21:11
0b7153b to
fc899f9
Compare
Remove unused imports left by rebase. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet
commented
Sep 1, 2026
gnodet
left a comment
gnodet
left a comment
Contributor
Author
There was a problem hiding this comment.
Well-adapted backport of credential scoping and server ID exact matching to 3.9.x. The OriginBoundAuthenticationSelector is identical to the 3.10.x version (correct, since it only depends on shared types). The DefaultRepositorySystemSessionFactory changes correctly target the 3.9.x API (DefaultRepositorySystemSession, Plexus Logger, wagon config keys).
One finding:
@sinceversion tag (DefaultRepositorySystemSessionFactory.java:131): The@sincetag onMAVEN_REPOSITORY_CREDENTIAL_SCOPEsays3.9.10, but Maven 3.9.10 was already released and does not contain this constant. The sibling PR #12954 correctly uses@since 3.10.0for the 3.10.x branch. This should be@since 3.9.17to match the next 3.9.x milestone.
Positive notes:
DefaultWagonManagerchange fromequalsIgnoreCasetoequalsaligns withLegacyRepositorySystem.injectAuthentication(already case-sensitive viaHashMap).- Relocation validation was already present on 3.9.x from a prior backport — correctly omitted from this diff.
DistributionManagementArtifactRelocationSourcedoesn't exist on 3.9.x — correctly omitted.- Credential scoping integration correctly adapts to
DefaultRepositorySystemSessionandaether.connector.permsconfig keys.
📋 PR Metadata
| Aspect | Current | Suggested |
|---|---|---|
| Labels | (none) | bug |
| Milestone | (none) | 3.9.17 |
🤖 This review was generated by ForgeBot.
| * | ||
| * @since 3.9.10 | ||
| */ | ||
| public static final String MAVEN_REPOSITORY_CREDENTIAL_SCOPE = "maven.repository.credentialScope"; |
Contributor
Author
There was a problem hiding this comment.
Suggested change
| public static final String MAVEN_REPOSITORY_CREDENTIAL_SCOPE = "maven.repository.credentialScope"; | |
| * @since 3.9.17 |
Maven 3.9.10 was already released and does not contain this constant. The sibling PR #12954 correctly uses @since 3.10.0. This should reference the next 3.9.x milestone (3.9.17).
|
@gnodet Please assign appropriate label to PR according to the type of change. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backport of Fix Set B (credential scoping + relocation validation + server ID matching) to maven-3.9.x.
MavenMetadataSource)OriginBoundAuthenticationSelector)equalsIgnoreCase→equalsinDefaultWagonManager)assertEquals(true, ...)→assertTrue(...)inMavenMetadataSourceRelocationTestSibling PRs:
Note:
DistributionManagementArtifactRelocationSourcedoes not exist on 3.9.x (introduced in 3.10.x), so that file's validation is not included in this backport.Test plan
MavenMetadataSourceRelocationTestcovers relocation validationOriginBoundAuthenticationSelectorTestcovers credential scoping🤖 Generated with Claude Code