Closed ctran closed 2 years ago
Is this something that could potentially be fixed in Maven itself?
Logically speaking, it should be fixed there but I haven't been able to create a reproducible scenario in normal maven usage. I think it may be specific to how it's being done in DefaultWagonManager where the credentials are stored in a POJO whereas it's being accessed directly via the same server
instance in frontend-maven-plugin:
SettingsDecryptionResult result =
settingsDecrypter.decrypt( new DefaultSettingsDecryptionRequest( server ) );
server = result.getServer();
AuthenticationInfo authInfo = new AuthenticationInfo();
authInfo.setUserName( server.getUsername() );
authInfo.setPassword( server.getPassword() );
authInfo.setPrivateKey( server.getPrivateKey() );
authInfo.setPassphrase( server.getPassphrase() );
return authInfo;
Ok, I guess we can fix it in this plugin then, until Maven maybe fixes it internally.
when will this fix be released?
Summary This change fixes a nasty threading issue due to the way the DefaultSettingsDecrypter works.
Our build jobs began to fail randomly with error " Could not download Node.js: Got error code 401 from the server". We have hundreds of builds a day and getting about 3 to 10 failures a day. Took a while but I was finally able to reproduce this issue consistently with the following setup:
Observation is at least one of the above projects will fail to download with a 401 error.
Tests and Documentation
Here's additional debug output from HttpClient (https://hc.apache.org/httpcomponents-client-4.5.x/logging.html)
Single thread mode:
Multithread mode:
You can see the password specified in the "Authorization" header is not the decrypted version. Once I looked at the code of DefaultSettingsDecrypter.java, it's pretty obvious there's no synchronization done at this line: