build: Configure maven central for plugin management #3438
Conversation
By default, Gradle uses `plugins.gradle.ort/m2` in order to download plugins. Unfortunately, this might result to forwarding the request to Maven Central for artifacts that cannot be found on `plugins.gradle.org`. This forwarding causes rate limiting for corporations trying to scan the ORT Server with the ORT Server which will then try to download artifacts from Maven Central [1]. More information can be found in [2]. Specifically, adding `mavenCentral()` as plugin repository will trigger the workaround implemented in [3] where `mavenCentral()` will be replaced by a corporate mirror of Maven Central. [1]: https://www.sonatype.com/blog/beyond-ips-addressing-organizational-overconsumption-in-maven-central [2]: https://blog.gradle.org/maven-central-mirror [3]: eclipse-apoapsis#3304 Signed-off-by: Marcel Bochtler <[email protected]>
|
As an alternative, maybe it is possible to add Maven Central as a plugin repository in the |
I thought that work-around would only apply to the runtime of ORT Server. But this change applies to the build time of ORT Server, or? |
The problem is that the init scrip template allows configuring a mirror for Maven Central, but this does not work for the automatic fallback of the Gradle plugin portal to Maven Central (it redirects to Maven Central if a plugin is requested which it does not contain). So adding Maven Central as a plugin repository before the plugin portal works around that because all plugins contained in Maven Central are not requested from the plugin portal anymore. This allows us to analyze this repository in our infrastructure where we would otherwise get 429 responses from Maven Central. However, I think it would be better to find a generic solution that does not require modifying the analyzed projects, like adapting the init script to inject Maven Central as a plugin repository (if this works). |
3 participants
By default, Gradle uses
plugins.gradle.ort/m2in order to download plugins. Unfortunately, this might result to forwarding the request to Maven Central for artifacts that cannot be found onplugins.gradle.org.This forwarding causes rate limiting for corporations trying to scan the ORT Server with the ORT Server which will then try to download artifacts from Maven Central 1.
More information can be found in 2.
Specifically, adding
mavenCentral()as plugin repository will trigger the workaround implemented in 3 wheremavenCentral()will be replaced by a corporate mirror of Maven Central.