Mailing-List: contact dev-help@accumulo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@accumulo.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
MIME-Version: 1.0
In-Reply-To: <53F12198.7040202@gmail.com>
References: 
 <CAGHyZ6JWuaXT3oC5qKMoUhocp_dWpWFjW02Ry+cUHdM7CaAYpA@mail.gmail.com>
 <53F12198.7040202@gmail.com>
From: Bill Havanki <bhavanki@clouderagovt.com>
Date: Mon, 18 Aug 2014 09:01:38 -0400
Message-ID: 
 <CAD-fFUJyzHMKckfcpW=vNJYJpSJDwe59u7c7cmifx_UpdfiD_g@mail.gmail.com>
Subject: Re: Update Maven requirements to handle HTTPS?
To: Accumulo Dev List <dev@accumulo.apache.org>
Content-Type: multipart/alternative; boundary=001a11c2cc18e667850500e6f98d

--001a11c2cc18e667850500e6f98d
Content-Type: text/plain; charset=UTF-8

A user with Maven pre-3.2.3 can configure the Maven Central URL to use
HTTPS by setting up a mirror in their settings.xml.

http://maven.apache.org/guides/mini/guide-mirror-settings.html

Josh, is your concern that folks won't be able to upgrade to 3.2.3?


On Sun, Aug 17, 2014 at 5:41 PM, Josh Elser <josh.elser@gmail.com> wrote:

> I see a massive headache incoming doing this. Is there a middle ground we
> can encourage people to use that isn't going to break everyone downstream?
>
> Can we make some recommendations to clients about how to use HTTPS instead
> of HTTP access to avoid the MITM attack (which I assume is the primary
> reason for suggesting the update).
>
>
> On 8/17/2014 4:57 PM, Sean Busbey wrote:
>
>> Now that Maven has released version 3.2.3 to default HTTPS access to maven
>> central, anyone have an objection to updating our enforcer rules to
>> require
>> it?
>>
>> http://maven.apache.org/docs/3.2.3/release-notes.html
>>
>>


-- 
// Bill Havanki
// Solutions Architect, Cloudera Govt Solutions
// 443.686.9283

--001a11c2cc18e667850500e6f98d--