sonatype / ossindex-public

Sonatype OSS Index - Public
Apache License 2.0
6 stars 9 forks source link

Allow to ignore ssl errors with a system property #39

Open rmannibucau opened 1 year ago

rmannibucau commented 1 year ago

Hi,

Just met a case where I will have temporarly SSL errors calling ossindex (company proxy stuff). It would be great to be able to disable the check and keep the plugin working instead of failing with a system property (like wagon) or maven parameter. Here is the stack:

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alert.createSSLException (Alert.java:131)
    at sun.security.ssl.TransportContext.fatal (TransportContext.java:371)
    at sun.security.ssl.TransportContext.fatal (TransportContext.java:314)
    at sun.security.ssl.TransportContext.fatal (TransportContext.java:309)
    at sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts (CertificateMessage.java:1357)
    at sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate (CertificateMessage.java:1232)
    at sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume (CertificateMessage.java:1175)
    at sun.security.ssl.SSLHandshake.consume (SSLHandshake.java:396)
    at sun.security.ssl.HandshakeContext.dispatch (HandshakeContext.java:480)
    at sun.security.ssl.HandshakeContext.dispatch (HandshakeContext.java:458)
    at sun.security.ssl.TransportContext.dispatch (TransportContext.java:201)
    at sun.security.ssl.SSLTransport.decode (SSLTransport.java:172)
    at sun.security.ssl.SSLSocketImpl.decode (SSLSocketImpl.java:1505)
    at sun.security.ssl.SSLSocketImpl.readHandshakeRecord (SSLSocketImpl.java:1420)
    at sun.security.ssl.SSLSocketImpl.startHandshake (SSLSocketImpl.java:455)
    at sun.security.ssl.SSLSocketImpl.startHandshake (SSLSocketImpl.java:426)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket (SSLConnectionSocketFactory.java:396)
    at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.upgrade (DefaultHttpClientConnectionOperator.java:193)
    at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.upgrade (PoolingHttpClientConnectionManager.java:389)
    at org.apache.http.impl.execchain.MainClientExec.establishRoute (MainClientExec.java:416)
    at org.apache.http.impl.execchain.MainClientExec.execute (MainClientExec.java:237)
    at org.apache.http.impl.execchain.ProtocolExec.execute (ProtocolExec.java:185)
    at org.apache.http.impl.execchain.RetryExec.execute (RetryExec.java:89)
    at org.apache.http.impl.execchain.RedirectExec.execute (RedirectExec.java:111)
    at org.apache.http.impl.client.InternalHttpClient.doExecute (InternalHttpClient.java:185)
    at org.apache.http.impl.client.CloseableHttpClient.execute (CloseableHttpClient.java:83)
    at org.apache.http.impl.client.CloseableHttpClient.execute (CloseableHttpClient.java:108)
    at org.sonatype.ossindex.service.client.transport.HttpClientTransport.post (HttpClientTransport.java:87)

Side note: in maven plugin it would be very neat to respect wagon ones this way the config is unique.