Enforce that Maven/Ivy repositories use https
This commit adds a check when a repository is added that we are using
https instead of http.
@@ -39,6 +39,8 @@ import org.gradle.api.artifacts.ModuleVersionIdentifier
import org.gradle.api.artifacts.ProjectDependency
import org.gradle.api.artifacts.ResolvedArtifact
import org.gradle.api.artifacts.dsl.RepositoryHandler
+import org.gradle.api.artifacts.repositories.IvyArtifactRepository
+import org.gradle.api.artifacts.repositories.MavenArtifactRepository
import org.gradle.api.execution.TaskExecutionGraph
import org.gradle.api.plugins.JavaBasePlugin
import org.gradle.api.plugins.JavaPlugin
@@ -558,6 +560,16 @@ class BuildPlugin implements Plugin<Project> {
/** Adds repositories used by ES dependencies */
static void configureRepositories(Project project) {
+ project.getRepositories().all { repository ->
+ if (repository instanceof MavenArtifactRepository) {
+ final MavenArtifactRepository maven = (MavenArtifactRepository) repository
+ assertRepositoryURIUsesHttps(project, maven.getUrl())
+ repository.getArtifactUrls().each { uri -> assertRepositoryURIUsesHttps(project, uri) }
+ } else if (repository instanceof IvyArtifactRepository) {
+ final IvyArtifactRepository ivy = (IvyArtifactRepository) repository
+ assertRepositoryURIUsesHttps(project, ivy.getUrl())
+ }
+ }
RepositoryHandler repos = project.repositories
if (System.getProperty("repos.mavenLocal") != null) {
// with -Drepos.mavenLocal=true we can force checking the local .m2 repo which is
@@ -581,6 +593,12 @@ class BuildPlugin implements Plugin<Project> {
}
}
+ private static void assertRepositoryURIUsesHttps(final Project project, final URI uri) {
+ if (uri != null && uri.toURL().getProtocol().equals("http")) {
+ throw new GradleException("repository on project with path [${project.path}] is using http for artifacts on [${uri.toURL()}]")
+ }
+ }
+
/**
* Returns a closure which can be used with a MavenPom for fixing problems with gradle generated poms.
*
