|
| 1 | +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Jason Penilla < [email protected]> |
| 3 | +Date: Wed, 18 Jun 2025 10:47:21 -0700 |
| 4 | +Subject: [PATCH] Paper: Avoid and discourage use of Maven Central as a CDN |
| 5 | + |
| 6 | +Original license: GPLv3 |
| 7 | +Original project: https://github.com/PaperMC/Paper |
| 8 | + |
| 9 | +https://github.com/PaperMC/Paper/commit/62b7f86dae659deb2fc450285452d7c1439f92dc |
| 10 | + |
| 11 | +Default LibraryLoader to Google's Maven Central mirror, add MavenLibraryResolver.MAVEN_CENTRAL_DEFAULT_MIRROR, and warn on use of Maven Central with MavenLibraryResolver |
| 12 | + |
| 13 | +https://www.sonatype.com/blog/maven-central-and-the-tragedy-of-the-commons |
| 14 | +https://www.sonatype.com/blog/beyond-ips-addressing-organizational-overconsumption-in-maven-central |
| 15 | + |
| 16 | +diff --git a/src/main/java/io/papermc/paper/plugin/loader/library/impl/MavenLibraryResolver.java b/src/main/java/io/papermc/paper/plugin/loader/library/impl/MavenLibraryResolver.java |
| 17 | +index 107705db2d82b7c191e5e625ec888e0bc3b03831..ebb52c2c8d5fe8ca25513aadae8168180a3d426e 100644 |
| 18 | +--- a/src/main/java/io/papermc/paper/plugin/loader/library/impl/MavenLibraryResolver.java |
| 19 | ++++ b/src/main/java/io/papermc/paper/plugin/loader/library/impl/MavenLibraryResolver.java |
| 20 | +@@ -41,7 +41,7 @@ import org.slf4j.LoggerFactory; |
| 21 | + * MavenLibraryResolver resolver = new MavenLibraryResolver(); |
| 22 | + * resolver.addDependency(new Dependency(new DefaultArtifact("org.jooq:jooq:3.17.7"), null)); |
| 23 | + * resolver.addRepository(new RemoteRepository.Builder( |
| 24 | +- * "central", "default", "https://repo1.maven.org/maven2/" |
| 25 | ++ * "central", "default", MavenLibraryResolver.MAVEN_CENTRAL_DEFAULT_MIRROR // Paper - Avoid and discourage use of Maven Central as a CDN |
| 26 | + * ).build()); |
| 27 | + * }</pre> |
| 28 | + * <p> |
| 29 | +@@ -50,6 +50,24 @@ import org.slf4j.LoggerFactory; |
| 30 | + @NullMarked |
| 31 | + public class MavenLibraryResolver implements ClassPathLibrary { |
| 32 | + |
| 33 | ++ // Paper start - Avoid and discourage use of Maven Central as a CDN |
| 34 | ++ /** |
| 35 | ++ * The default Maven Central mirror, configurable through the {@code PAPER_DEFAULT_CENTRAL_REPOSITORY} environment |
| 36 | ++ * variable. Use this instead of Maven Central directly when you do not have your own mirror, as using |
| 37 | ++ * Maven Central as a CDN is against the Maven Central Terms of Service, and you will cause users to hit |
| 38 | ++ * rate limits. |
| 39 | ++ * |
| 40 | ++ * <p>This repository is also used by the legacy {@link org.bukkit.plugin.java.LibraryLoader}.</p> |
| 41 | ++ */ |
| 42 | ++ public static final String MAVEN_CENTRAL_DEFAULT_MIRROR = getDefaultMavenCentralMirror(); |
| 43 | ++ private static final List<String> MAVEN_CENTRAL_URLS = List.of( |
| 44 | ++ "https://repo1.maven.org/maven2", |
| 45 | ++ "http://repo1.maven.org/maven2", |
| 46 | ++ "https://repo.maven.apache.org/maven2", |
| 47 | ++ "http://repo.maven.apache.org/maven2" |
| 48 | ++ ); |
| 49 | ++ // Paper end - Avoid and discourage use of Maven Central as a CDN |
| 50 | ++ |
| 51 | + private static final Logger LOGGER = LoggerFactory.getLogger("MavenLibraryResolver"); |
| 52 | + |
| 53 | + private final RepositorySystem repository; |
| 54 | +@@ -105,6 +123,14 @@ public class MavenLibraryResolver implements ClassPathLibrary { |
| 55 | + * dependencies from |
| 56 | + */ |
| 57 | + public void addRepository(final RemoteRepository remoteRepository) { |
| 58 | ++ // Paper start - Avoid and discourage use of Maven Central as a CDN |
| 59 | ++ if (MAVEN_CENTRAL_URLS.stream().anyMatch(remoteRepository.getUrl()::startsWith)) { |
| 60 | ++ LOGGER.warn( |
| 61 | ++ "Use of Maven Central as a CDN is against the Maven Central Terms of Service. Use MavenLibraryResolver.MAVEN_CENTRAL_DEFAULT_MIRROR instead.", |
| 62 | ++ new RuntimeException("Plugin used Maven Central for library resolution") |
| 63 | ++ ); |
| 64 | ++ } |
| 65 | ++ // Paper end - Avoid and discourage use of Maven Central as a CDN |
| 66 | + this.repositories.add(remoteRepository); |
| 67 | + } |
| 68 | + |
| 69 | +@@ -130,4 +156,17 @@ public class MavenLibraryResolver implements ClassPathLibrary { |
| 70 | + store.addLibrary(file.toPath()); |
| 71 | + } |
| 72 | + } |
| 73 | ++ |
| 74 | ++ // Paper start - Avoid and discourage use of Maven Central as a CDN |
| 75 | ++ private static String getDefaultMavenCentralMirror() { |
| 76 | ++ String central = System.getenv("PAPER_DEFAULT_CENTRAL_REPOSITORY"); |
| 77 | ++ if (central == null) { |
| 78 | ++ central = System.getProperty("org.bukkit.plugin.java.LibraryLoader.centralURL"); |
| 79 | ++ } |
| 80 | ++ if (central == null) { |
| 81 | ++ central = "https://maven-central.storage-download.googleapis.com/maven2"; |
| 82 | ++ } |
| 83 | ++ return central; |
| 84 | ++ } |
| 85 | ++ // Paper end - Avoid and discourage use of Maven Central as a CDN |
| 86 | + } |
| 87 | +diff --git a/src/main/java/org/bukkit/plugin/java/LibraryLoader.java b/src/main/java/org/bukkit/plugin/java/LibraryLoader.java |
| 88 | +index 7e4e702845f61703f0741add59f7cfc0afea1543..012ba8ee3d84a7bb09068e42fd1bae8ad221622e 100644 |
| 89 | +--- a/src/main/java/org/bukkit/plugin/java/LibraryLoader.java |
| 90 | ++++ b/src/main/java/org/bukkit/plugin/java/LibraryLoader.java |
| 91 | +@@ -47,19 +47,11 @@ public class LibraryLoader { |
| 92 | + public static java.util.function.BiFunction<URL[], ClassLoader, URLClassLoader> LIBRARY_LOADER_FACTORY; // Paper - rewrite reflection in libraries |
| 93 | + public static java.util.function.Function<List<java.nio.file.Path>, List<java.nio.file.Path>> REMAPPER; // Paper - remap libraries |
| 94 | + |
| 95 | +- // TODO: Consider moving this and adding per plugin support for defining repositories |
| 96 | ++ // Paper start - Avoid and discourage use of Maven Central as a CDN |
| 97 | + private static List<RemoteRepository> getRepositories() { |
| 98 | +- String central = System.getenv("PAPER_DEFAULT_CENTRAL_REPOSITORY"); |
| 99 | +- if (central == null) { |
| 100 | +- central = System.getProperty("org.bukkit.plugin.java.LibraryLoader.centralURL"); |
| 101 | +- } |
| 102 | +- if (central == null) { |
| 103 | +- central = "https://repo.maven.apache.org/maven2"; |
| 104 | +- } |
| 105 | +- |
| 106 | +- return Arrays.asList(new RemoteRepository.Builder("central", "default", central).build()); |
| 107 | +- |
| 108 | ++ return List.of(new RemoteRepository.Builder("central", "default", io.papermc.paper.plugin.loader.library.impl.MavenLibraryResolver.MAVEN_CENTRAL_DEFAULT_MIRROR).build()); |
| 109 | + } |
| 110 | ++ // Paper end - Avoid and discourage use of Maven Central as a CDN |
| 111 | + |
| 112 | + public LibraryLoader(@NotNull Logger logger) { |
| 113 | + this.logger = logger; |
| 114 | +@@ -87,7 +79,7 @@ public class LibraryLoader { |
| 115 | + session.setSystemProperties(System.getProperties()); |
| 116 | + session.setReadOnly(); |
| 117 | + |
| 118 | +- this.repositories = repository.newResolutionRepositories(session, getRepositories()); |
| 119 | ++ this.repositories = repository.newResolutionRepositories(session, getRepositories()); // Paper - Avoid and discourage use of Maven Central as a CDN |
| 120 | + } |
| 121 | + |
| 122 | + @Nullable |
0 commit comments