Skip to content

Scope Maven mirror to external:* instead of * - #1594

Merged
sverdlov93 merged 2 commits into
masterfrom
fix-maven-mirror-external-scope
Jul 28, 2026
Merged

Scope Maven mirror to external:* instead of *#1594
sverdlov93 merged 2 commits into
masterfrom
fix-maven-mirror-external-scope

Conversation

@sverdlov93

Copy link
Copy Markdown
Contributor

Problem

ConfigureArtifactoryRepository writes <mirrorOf>*</mirrorOf> into ~/.m2/settings.xml. In Maven, * matches every repository — including ones declared on localhost or with a file:// URL, such as the staging repository used by maven-invoker-plugin integration tests.

Artifactory cannot serve artifacts that live on the developer's own machine, so mirroring those repositories can only fail to resolve. Excluding them costs no governance: they are not downloads from a remote registry.

Fix

Scope the mirror to external:*, which per the Maven mirror guide matches all repositories except localhost / file:// ones. Every repository fetched over the network still resolves through Artifactory.

before:  <mirrorOf>*</mirrorOf>           → also captures localhost / file://
after:   <mirrorOf>external:*</mirrorOf>  → remote repositories only

Scope note: this does not change which remote repositories are intercepted. It is not a fix for unrelated Maven builds failing when the configured repository does not proxy a project's upstreams.

Tests

  • TestConfigureArtifactoryRepository_MirrorScopeIsExternalOnly — reads mirrorOf by mirror id, so a user mirror that happens to declare the same scope cannot satisfy the assertion; also asserts an existing user mirror keeps its own mirrorOf.
  • TestConfigureArtifactoryRepository_MirrorScopeStableOnRepoint — re-running against a different repository keeps exactly one mirror, keeps the external:* scope, and repoints the URL.
  • Existing user-mirror fixtures (central, *,!local-repo, blocked-*) left unchanged.

Verified locally: go build, go vet, gofmt clean; the artifactory/utils/maven suite passes; reverting the constant to * fails both new tests; and jf setup mvn's tests in jfrog-cli-artifactory (TestSetupCommand_Maven, TestSetupCommand_MavenCorrupted) pass against this branch via a temporary replace directive.


  • All tests passed. If this feature is not already covered by the tests, I added new tests.
  • All static analysis checks passed.
  • This pull request is on the master branch.
  • I used gofmt for formatting the code before submitting the pull request.

🤖 Generated with Claude Code

Artifactory cannot serve artifacts that live on the developer's own machine,
so mirroring localhost/file:// repositories can only fail to resolve. Excluding
them costs no governance: they are not downloads from a remote registry. Every
repository fetched over the network still resolves through Artifactory.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@sverdlov93 sverdlov93 added the bug Something isn't working label Jul 28, 2026
@github-actions

Copy link
Copy Markdown
Contributor

👍 Frogbot scanned this pull request and did not find any new security issues.


@sverdlov93
sverdlov93 merged commit 591d487 into master Jul 28, 2026
13 checks passed
@sverdlov93
sverdlov93 deleted the fix-maven-mirror-external-scope branch July 28, 2026 10:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants