fnproject / fdk-java

Java API and runtime for fn.
Apache License 2.0
142 stars 53 forks source link

Workaround to make the build work after Maven fixed CVE-2021-26291 #254

Closed hhexo closed 3 years ago

hhexo commented 3 years ago

Maven has added a default setting in the settings.xml which blocks access to any HTTP-based repository. However, as part of the FDK build we are running an HTTP server hosting the built JARs in a container and accessing it in a Maven command running in another container. This is not allowed anymore by default due to Maven's change. We introduce a workaround that uses a local settings file to temporarily disable the blockage and redirects an HTTP-based repo queries to our local container running the HTTP server. The change is only relevant for the copy-dependencies step of the build image creations, and the local settings file is deleted afterwards, in a way that does not even leave a layer with an "insecure" Maven settings file in the container.

Also we try to unbreak the CircleCI build by using the latest image and providing a custom Maven settings file with the appropriate blocker and with the fix to SUREFIRE-1588.