From 0dc533d22c6c99519f9358f0a5207ae2b41ce429 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Efe=20G=C3=B6kdemir?= Date: Fri, 9 Oct 2026 00:05:31 +0300 Subject: [PATCH] Improve guidance for denied auto-discovered prefixes --- .../PrefixesRemoteRepositoryFilterSource.java | 16 ++++++++++------ ...epositoryFilterSourceVerifyDeniedTest.java | 19 ++++++++++++++++++- 2 files changed, 28 insertions(+), 7 deletions(-) diff --git a/maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/filter/PrefixesRemoteRepositoryFilterSource.java b/maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/filter/PrefixesRemoteRepositoryFilterSource.java index 41efd49cb..dec424edf 100644 --- a/maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/filter/PrefixesRemoteRepositoryFilterSource.java +++ b/maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/filter/PrefixesRemoteRepositoryFilterSource.java @@ -590,12 +590,16 @@ private Result acceptPrefix(RemoteRepository repository, String path) { + " (verified served despite stale auto-discovered prefixes)"); } } - return result( - accepted, - NAME, - accepted - ? "Path " + path + " allowed from " + repository.getId() - : "Path " + path + " NOT allowed from " + repository.getId()); + String reasoning = accepted + ? "Path " + path + " allowed from " + repository.getId() + : "Path " + path + " NOT allowed from " + repository.getId(); + if (!accepted && cachedPrefixes.autoDiscovered()) { + reasoning += ". The auto-discovered prefixes file may be incomplete. If this repository is a virtual " + + "aggregate, set -D" + CONFIG_PROP_VERIFY_DENIED_DROPS_TREE + "." + repository.getId() + + "=true to drop its prefixes file for this session, or contact the repository administrator. " + + "See https://maven.apache.org/resolver/remote-repository-filtering.html"; + } + return result(accepted, NAME, reasoning); } private Result noInputResult(RemoteRepository repository, String reasoning) { diff --git a/maven-resolver-impl/src/test/java/org/eclipse/aether/internal/impl/filter/PrefixesRemoteRepositoryFilterSourceVerifyDeniedTest.java b/maven-resolver-impl/src/test/java/org/eclipse/aether/internal/impl/filter/PrefixesRemoteRepositoryFilterSourceVerifyDeniedTest.java index 6c3314ead..3539ecf42 100644 --- a/maven-resolver-impl/src/test/java/org/eclipse/aether/internal/impl/filter/PrefixesRemoteRepositoryFilterSourceVerifyDeniedTest.java +++ b/maven-resolver-impl/src/test/java/org/eclipse/aether/internal/impl/filter/PrefixesRemoteRepositoryFilterSourceVerifyDeniedTest.java @@ -255,6 +255,21 @@ void verificationCanBeDisabled() throws Exception { verify(transporter, never()).peek(any(PeekTask.class)); } + @Test + void deniedAutoDiscoveredPathExplainsRepositorySpecificWorkaround() { + session.setConfigProperty("aether.remoteRepositoryFilter.prefixes.verifyDenied", "false"); + RemoteRepositoryFilter filter = subject.getRemoteRepositoryFilter(session); + assertNotNull(filter); + + RemoteRepositoryFilter.Result result = filter.acceptArtifact(remoteRepository, jenkinsArtifact); + + assertFalse(result.isAccepted()); + assertTrue(result.reasoning() + .contains("aether.remoteRepositoryFilter.prefixes.verifyDeniedDropsTree.jenkins-public=true")); + assertTrue(result.reasoning().contains("contact the repository administrator")); + assertTrue(result.reasoning().contains("https://maven.apache.org/resolver/remote-repository-filtering.html")); + } + @Test void offlineSessionSkipsVerification() throws Exception { session.setOffline(true); @@ -289,7 +304,9 @@ void userProvidedPrefixesAreAuthoritative() throws Exception { assertNotNull(filter); // deliberately user-authored prefixes are never second-guessed - assertFalse(filter.acceptArtifact(remoteRepository, jenkinsArtifact).isAccepted()); + RemoteRepositoryFilter.Result result = filter.acceptArtifact(remoteRepository, jenkinsArtifact); + assertFalse(result.isAccepted()); + assertFalse(result.reasoning().contains("verifyDeniedDropsTree")); verify(transporter, never()).peek(any(PeekTask.class)); } }