Maven to Repository protocol

I have used this minimalistic proxy service:

http://www.jcgonzalez.com/java-simple-proxy-socket-server-examples#1

and just added a "System.out.println("read: " + new String(request));" after the "outToServer.flush();"

then in my settings.xml I point the mirror to localhost instead of the real Nexus Repository service, and I start my proxy pointing to Nexus and listening on port 80. This way, I can intercept all http request issued by Maven.


The result is quite simple:


Starting proxy for nexus-java:80 on port 80
read: GET /content/repositories/approved-from-central/commons-logging/commons-logging-api/1.1/commons-logging-api-1.1.pom HTTP/1.1
Cache-control: no-cache
Cache-store: no-store
Pragma: no-cache
Expires: 0
Accept-Encoding: gzip
User-Agent: Apache-Maven/3.3.9 (Java 1.8.0_102; Windows 7 6.1)
Host: localhost
Connection: Keep-Alive



read: GET /content/repositories/approved-from-central/commons-logging/commons-logging-api/1.1/commons-logging-api-1.1.pom.sha1 HTTP/1.1
Cache-control: no-cache
Cache-store: no-store
Pragma: no-cache
Expires: 0
Accept-Encoding: gzip
User-Agent: Apache-Maven/3.3.9 (Java 1.8.0_102; Windows 7 6.1)
Host: localhost
Connection: Keep-Alive


read: GET /content/repositories/approved-from-central/commons-logging/commons-logging-api/1.1/commons-logging-api-1.1.jar HTTP/1.1
Cache-control: no-cache
Cache-store: no-store
Pragma: no-cache
Expires: 0
Accept-Encoding: gzip
User-Agent: Apache-Maven/3.3.9 (Java 1.8.0_102; Windows 7 6.1)
Host: localhost
Connection: Keep-Alive


read: GET /content/repositories/approved-from-central/commons-logging/commons-logging-api/1.1/commons-logging-api-1.1.jar.sha1 HTTP/1.1
Cache-control: no-cache
Cache-store: no-store
Pragma: no-cache
Expires: 0
Accept-Encoding: gzip
User-Agent: Apache-Maven/3.3.9 (Java 1.8.0_102; Windows 7 6.1)
Host: localhost
Connection: Keep-Alive


read: GET /content/repositories/approved-from-central/commons-lang/commons-lang/2.1/commons-lang-2.1.pom HTTP/1.1
Cache-control: no-cache
Cache-store: no-store
Pragma: no-cache
Expires: 0
Accept-Encoding: gzip
User-Agent: Apache-Maven/3.3.9 (Java 1.8.0_102; Windows 7 6.1)
Host: localhost
Connection: Keep-Alive


read: GET /content/repositories/approved-from-central/commons-lang/commons-lang/2.1/commons-lang-2.1.pom.sha1 HTTP/1.1
Cache-control: no-cache
Cache-store: no-store
Pragma: no-cache
Expires: 0
Accept-Encoding: gzip
User-Agent: Apache-Maven/3.3.9 (Java 1.8.0_102; Windows 7 6.1)
Host: localhost
Connection: Keep-Alive


read: GET /content/repositories/approved-from-central/commons-lang/commons-lang/2.1/commons-lang-2.1.jar HTTP/1.1
Cache-control: no-cache
Cache-store: no-store
Pragma: no-cache
Expires: 0
Accept-Encoding: gzip
User-Agent: Apache-Maven/3.3.9 (Java 1.8.0_102; Windows 7 6.1)
Host: localhost
Connection: Keep-Alive


read: GET /content/repositories/approved-from-central/commons-lang/commons-lang/2.1/commons-lang-2.1.jar.sha1 HTTP/1.1
Cache-control: no-cache
Cache-store: no-store
Pragma: no-cache
Expires: 0
Accept-Encoding: gzip
User-Agent: Apache-Maven/3.3.9 (Java 1.8.0_102; Windows 7 6.1)
Host: localhost
Connection: Keep-Alive




so it's extremely easy to parse the GET command and implement a firewall/filter to block components that you know are harmful.

OracleXETNSListener runs on port 8080

If you run locally a Oracle XE instance, you are bound to have it occupy port 8080 (with catastrophic consequences for all other application using this popular port)

Run tcpview to make sure that the process tnslsnr.exe is using the port 8080

You can then open Sqldeveloper, login as SYS, and run this:

begin
dbms_xdb.sethttpport('9090');
end;

then restart the oracle listener (maybe first shut it down, they start your other application using port 8080, then start the oracle listener)

it's a sad world. Why is everyone using 8080, there are so many integer numbers...

Maven, anatomy of a pom (YAMR, yet another Maven rant)

Maven is horrendous, if an animal had been designed like Maven he would probably have 3 legs and his bowels inside out and spend in hospital 3 hours a day to check what is wrong, because there is no internal diagnostics and things fail mostly silently and obscurely, there is almost no proactive remediation advice.

Everything in it is wrong, it's "broken by design". Its XML DSL is a fist in the eye, totally non-fluent. The amount of copy/paste is appalling.

However since it's so ubiquitous, we have to make some sense out of this terrible shapeless configuration molassa.