feat: fetch Maven metadata from specified repositories #1286
Conversation
cuixq
requested review from
michaelkedar,
another-rex and
oliverchang
and removed request for
michaelkedar
internal/resolution/client/client.go
Outdated
| // UpdateRegistries updates the registries to fetch data. | ||
| UpdateRegistries(registries []string) |
There was a problem hiding this comment.
Not sure about using []string here: npm for example would want a map for {"@scope": "url"} (if we were to implement it), and both would eventually need authentication information per url.
Could this take in a Manifest? (but we'd also need to work with lockfiles...)
There was a problem hiding this comment.
I think it makes sense to make this function take a slice of struct instead of a slice of string - there is also Maven specific information I want to add to this struct e.g. if it is allowed to download snapshots.
| @@ -151,6 +151,16 @@ func (c *MavenRegistryClient) MatchingVersions(ctx context.Context, vk resolve.V | |||
| return resolve.MatchRequirement(vk, versions), nil | |||
| } | |||
|
|
|||
| func (c *MavenRegistryClient) UpdateRegistries(registries []Registry) error { | |||
| for _, reg := range registries { | |||
| if err := c.api.AddRegistry(reg.URL); err != nil { | |||
There was a problem hiding this comment.
do we need to clear any existing registries? Update implies we will overwrite all existing ones?
There was a problem hiding this comment.
We don't want to clear the existing registries - maybe this should be renamed to AddRegistries and have another SetRegistries to clear and set the registries (though not sure if this has any use case)
|
I mark this PR to draft - the registries should not be added when importing dependencies, but that is now done by |
#1286 adds support for Maven registry during resolution. As a follow up, this PR updates the documentation for transitive scanning about specifying data source during resolution as well as specifying Maven registry. This PR also corrects the deps.dev API version we are using. We also need to update the documentation in #1181.
#1045
There are repositories defined in a Maven pom.xml. When looking for an artifact, these repositories are searched one by one until the artifact is found. Maven Central is the default registry to try at the last.
To support this behaviour, this PR:
MavenRegistryAPIClienthost a list of registries besides the default registryUpdateRegistriestoDependencyClientto update the registriesfixscanto align with what we have forfixTODO: