Maven：尽管 settings.xml 已使用 HTTPS 配置存储库，但无法检索插件描述符和对等体未验证错误

Question

我有 Maven 3.0.5 和 Java 8 设置（这是针对特定项目的，不会修改堆栈版本）。

我知道 Apache 强制所有 Maven 存储库仅使用 HTTPS 的新决定，否则 Maven 客户端将无法与存储库服务器通信。

似乎我已经在 ~/.m2/settings.xml 中配置了所有必要的设置，但出于某种原因，当我在任何构建阶段（比如 mvn clean）时，Maven 默认为 HTTP 而不是不关心 settings.xml - 它仍然尝试使用 HTTP 协议下载 references/dependencies。

我的例子settings.xml （为了简单起见，我删除了项目特定的东西，只留下了与问题相关的东西）：

<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
                    https://maven.apache.org/xsd/settings-1.0.0.xsd">
<repositories>
  <repository>
    <id>central</id>
    <url>https://repo1.maven.org/maven2/</url>
  </repository>

  <repository>
    <id>central</id>
    <url>https://repo.maven.apache.org/maven2/</url>
  </repository>
</repositories>

这是我在执行 mvn archetype:generate 时得到的结果，只是为了测试 Maven 的行为（对于任何其他试图访问服务器的命令来说，这个问题一直存在）：

[INFO] Scanning for projects... 

Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-clean-plugin/2.5/maven-clean-plugin-2.5.pom
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-clean-plugin:2.5: Plugin org.apache.maven.plugins:maven-clean-plugin:2.5 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-clean-plugin:jar:2.5

Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-install-plugin/2.3/maven-install-plugin-2.3.pom
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-install-plugin:2.3: Plugin org.apache.maven.plugins:maven-install-plugin:2.3 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-install-plugin:jar:2.3

Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-deploy-plugin/2.7/maven-deploy-plugin-2.7.pom
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-deploy-plugin:2.7: Plugin org.apache.maven.plugins:maven-deploy-plugin:2.7 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-deploy-plugin:jar:2.7

Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-site-plugin/3.0/maven-site-plugin-3.0.pom
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-site-plugin:3.0: Plugin org.apache.maven.plugins:maven-site-plugin:3.0 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-site-plugin:jar:3.0

Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-antrun-plugin/1.3/maven-antrun-plugin-1.3.pom
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-antrun-plugin:1.3: Plugin org.apache.maven.plugins:maven-antrun-plugin:1.3 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-antrun-plugin:jar:1.3

Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-assembly-plugin/2.2-beta-5/maven-assembly-plugin-2.2-beta-5.pom
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-assembly-plugin:2.2-beta-5: Plugin org.apache.maven.plugins:maven-assembly-plugin:2.2-beta-5 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-assembly-plugin:jar:2.2-beta-5

Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-dependency-plugin/2.1/maven-dependency-plugin-2.1.pom
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-dependency-plugin:2.1: Plugin org.apache.maven.plugins:maven-dependency-plugin:2.1 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-dependency-plugin:jar:2.1

Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-release-plugin/2.0/maven-release-plugin-2.0.pom
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-release-plugin:2.0: Plugin org.apache.maven.plugins:maven-release-plugin:2.0 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.apache.maven.plugins:maven-release-plugin:jar:2.0

Downloading: http://repo.maven.apache.org/maven2/org/codehaus/mojo/maven-metadata.xml

Downloading: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-metadata.xml

[WARNING] Could not transfer metadata org.apache.maven.plugins/maven-metadata.xml from/to central (http://repo.maven.apache.org/maven2): Failed to transfer file: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-metadata.xml. Return code is: 501 , ReasonPhrase:HTTPS Required.

[WARNING] Could not transfer metadata org.codehaus.mojo/maven-metadata.xml from/to central (http://repo.maven.apache.org/maven2): Failed to transfer file: http://repo.maven.apache.org/maven2/org/codehaus/mojo/maven-metadata.xml. Return code is: 501 , ReasonPhrase:HTTPS Required.

[WARNING] Failure to transfer org.apache.maven.plugins/maven-metadata.xml from http://repo.maven.apache.org/maven2 was cached in the local repository, resolution will not be reattempted until the update interval of central has elapsed or updates are forced.

Original error: Could not transfer metadata org.apache.maven.plugins/maven-metadata.xml from/to central (http://repo.maven.apache.org/maven2): Failed to transfer file: http://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-metadata.xml. Return code is: 501 , ReasonPhrase:HTTPS Required.

[WARNING] Failure to transfer org.codehaus.mojo/maven-metadata.xml from http://repo.maven.apache.org/maven2 was cached in the local repository, resolution will not be reattempted until the update interval of central has elapsed or updates are forced.

Original error: Could not transfer metadata org.codehaus.mojo/maven-metadata.xml from/to central (http://repo.maven.apache.org/maven2): Failed to transfer file: http://repo.maven.apache.org/maven2/org/codehaus/mojo/maven-metadata.xml. Return code is: 501 , ReasonPhrase:HTTPS Required.

我该怎么办？如您所见，它仍然使用 HTTP，相应地，我得到 HTTP 501。

Answer 1

在您的情况下，它似乎适用于依赖项，但不适用于插件。您需要定义一个 <profile> 即 activeByDefault 并包含快照和发布的 <pluginRepositories/> 部分。

Maven 有两种类型的存储库：

依赖关系
对于插件

<mirrorOf> 部分仅处理依赖存储库。

Answer 2

我建议走以下路径：

<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.1.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.1.0 http://maven.apache.org/xsd/settings-1.1.0.xsd">

  <mirrors>
    <mirror>
      <id>central</id>
      <name>central</name>
      <url>https://repo1.maven.org/maven2/</url>
      <mirrorOf>*</mirrorOf>
    </mirror>
  </mirrors>

</settings>

这将通过上述 URL 重定向所有请求。如果您的公司环境中有存储库管理器，最好使用这个，让存储库管理器处理 https 内容。

还升级了 Maven 到最新版本 3.6.3，我想你没有使用最新版本的插件，我强烈建议升级有很多改进。

Answer 3

有两个问题：

问题一：
[WARNING] Failed to retrieve plugin descriptor for .. (whatever plugin name) 几乎在任何构建阶段都会发出警告，这表明（重要>）检索 插件描述符或其依赖项（这意味着 plugins，而不是 项目依赖项 !) 不会成功。

这里，Maven 尝试通过 HTTP 与端点机器（存储库）通信，尽管事实上(!)，我已经自定义了我的配置.m2\settings.xml 文件和所有存储库定义条目分别使用 HTTPS，似乎 Maven 应该通过 HTTPS 尝试一切..但不，它使用 HTTP 插件，并且与 Maven 存储库的任何 HTTP 通信是 forbidden since the 15th of January, 2020.

我解决这个问题的方法是将 <profiles/> 和 <pluginRepositories/> 定义和配置为，但我不得不详细说明和扩展该答案。

所以，这是我现成的工作 settings.xml 示例：（注意，为了安全起见，我在配置文件和存储库中都提供了替代存储库）

<settings
        xmlns="http://maven.apache.org/SETTINGS/1.0.0"                                                                                                                                     $    xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
        https://maven.apache.org/xsd/settings-1.0.0.xsd">

    <profiles>
        <profile>
            <id>ssl-profile</id>
            <activation>
                <activeByDefault>true</activeByDefault>
            </activation>

            <repositories>
                <repository>
                    <id>central-1</id>
                    <url>https://repo1.maven.org/maven2</url>
                    <snapshots>
                        <enabled>false</enabled>
                    </snapshots>
                </repository>
            </repositories>
            
            <pluginRepositories>
                <pluginRepository>
                    <id>central-2</id>
                    <url>https://repo1.maven.org/maven2</url>
                    <snapshots>
                        <enabled>false</enabled>
                    </snapshots>
                </pluginRepository>
            </pluginRepositories>
        </profile>

        <repositories>
            <repository>
                <id>central1</id>
                <url>https://repo1.maven.org/maven2/</url>
            </repository>
            <repository>
                <id>central2</id>
                <url>https://repo.maven.apache.org/maven2/</url>
            </repository>
        </repositories>
    </profiles>
</settings>

在这个问题解决后，最后 Maven 尝试通过 HTTPS 连接到所有存储库，然后我有另一个，

问题二：
peer not authenticated 后跟 Return code is: 501 , ReasonPhrase:HTTPS Required.

这有点棘手，但解决这个问题的方法是使用信任库 cacerts 文件。

首先，检查您是否有信任库文件 cacerts 以及它是否为空。它必须 NOT 为空，这非常重要。

似乎，在 OpenJDK 11 和 Windows/Linux 系统的一些其他构建中，cacerts 文件丢失或存在，但为空；但是，根据我的观察，它存在于 Oracle JDK 个版本中。

在 Windows 版本上，它应该在 %JAVA_HOME%\lib\security\;
在 Linux 构建中，它可能会有所不同（取决于 Linux 发行版和您的设置），但就我而言，它在 /etc/ssl/certs 之下（我认为那是 Linux 的证书文件夹，特别是 Java 的那个）。

如果您发现 cacerts 文件不存在或为空（只需检查文件大小，它应该大于几位），您可以：

只需从其他 JDK/JRE 版本复制粘贴现有 cacerts 文件；
Generate 一个 cacerts 信任库文件并向其中添加证书。在这种情况下，您需要根据需要添加任意数量的证书，因此，使用复制粘贴变体可能更容易。

希望对您有所帮助。

Maven：尽管 settings.xml 已使用 HTTPS 配置存储库，但无法检索插件描述符和对等体未验证错误

Maven: Failed to retrieve plugin descriptor and peer not authenticated errors despite the settings.xml having repositories configured with HTTPS

java

https

maven-3

maven