Downloading artifacts from private HTTP repo in AEMaaCS pipeline

[somen-sarkar]

Hi All,

The AEMaaCS project documentation(1) states that for private repositories, elements like servers are combined into the default settings.xml file(2) managed by Cloud Manager, located at .cloudmanager/maven/settings.xml. However, some questions remain:

1. Beyond <servers> element, can other elements like <mirrors> be overridden within the cloud pipeline?
2. Since Maven 3.8.1 (3), external HTTP repositories are blocked by default. Can artifacts still be downloaded from HTTP repositories during the cloud pipeline? Is HTTPS mandatory for all repositories in the cloud pipeline build?

1. https://experienceleague.adobe.com/docs/experience-manager-cloud-service/content/implementing/using-...
2. https://maven.apache.org/settings.html
3. https://maven.apache.org/docs/3.8.1/release-notes.html

Appreciate your viewpoints on the same. 

Thanks,

Somen

[PAGIDALAGURUKRISHNA · Accepted solution]

Hi @somen-sarkar 

To address your questions regarding Maven settings in AEM as a Cloud Service (AEMaaCS), let's delve into the official documentation and Maven's behavior.

Can other elements like <mirrors> be overridden within the cloud pipeline?

Based on the AEMaaCS documentation, there isn't explicit mention of overriding the <mirrors> element within the cloud pipeline configuration. The provided documents primarily discuss the configuration of CI/CD pipelines, deployment types, and the management of code and configuration through Cloud Manager. However, given that Cloud Manager integrates with Maven for building projects, it's reasonable to infer that the settings.xml configuration would follow Maven's standard practices. Usually, configuration elements such as <mirrors> can be specified within a project's settings.xml file, which Maven would then use during the build process. If AEMaaCS allows for customization of the settings.xml file beyond the <servers> element, it would likely permit this. However, without explicit documentation, it is not possible to definitively state that <mirrors> or other elements can be overridden. It may be necessary to test this within Cloud Manager .

Regarding Maven 3.8.1 and external HTTP repositories:

As of Maven 3.8.1, external HTTP repositories are blocked by default to encourage the use of HTTPS, which is more secure. The Maven release notes state that repositories must use HTTPS. This change would apply to AEMaaCS as well, given that it would use a version of Maven that complies with this requirement. Therefore, artifacts would need to be downloaded from HTTPS repositories during the cloud pipeline build process in AEMaaCS. If you have a repository that is only available via HTTP, you would need to configure it to use HTTPS to ensure compatibility with the cloud pipeline in AEMaaCS.

For more detailed information, you may refer to the following resources:

• CI/CD Pipelines in AEMaaCS: Documentation
• Maven Settings Reference: Documentation
• Maven 3.8.1 Release Notes: Documentation

Please note that while these deductions are based on the current documentation and behavior of Maven, it's always advisable to conduct practical tests within the AEMaaCS environment

[somen-sarkar]

Hi @PAGIDALAGURUKRISHNA ,

Thanks for your inputs. 

Tried few things in cloud to test the mirrors behavior. Looks like the Cloud Manager completely ignores the <models> overridden values .As documented it only consider the servers element to merge . So currently mirrors can not be overridden.

Agree with your viewpoints that it's better to have HTTPS enabled from security perspective.

Thanks,

Somen