最近升级 Maven 到 3.8.1 后，mvn 编译的时候总是提示拉不到依赖，报错如下：
Could not validate integrity of download from http://0.0.0.0/...
全部报错如下：
[WARNING] Could not validate integrity of download from http://0.0.0.0/com/alibaba/nacos/nacos-client-mse-extension/1.4.2-SNAPSHOT/maven-metadata.xmlorg.eclipse.aether.transfer.ChecksumFailureException: Checksum validation failed, expected <!doctype but is 18420d7f1430a348837b97a31a80e374e3b00254 at org.eclipse.aether.connector.basic.ChecksumValidator.validateExternalChecksums (ChecksumValidator.java:174) at org.eclipse.aether.connector.basic.ChecksumValidator.validate (ChecksumValidator.java:103) at org.eclipse.aether.connector.basic.BasicRepositoryConnector$GetTaskRunner.runTask (BasicRepositoryConnector.java:460) at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run (BasicRepositoryConnector.java:364) at org.eclipse.aether.util.concurrency.RunnableErrorForwarder$1.run (RunnableErrorForwarder.java:75) at org.eclipse.aether.connector.basic.BasicRepositoryConnector$DirectExecutor.execute (BasicRepositoryConnector.java:628) at org.eclipse.aether.connector.basic.BasicRepositoryConnector.get (BasicRepositoryConnector.java:235) at org.eclipse.aether.internal.impl.DefaultMetadataResolver$ResolveTask.run (DefaultMetadataResolver.java:573) at org.eclipse.aether.util.concurrency.RunnableErrorForwarder$1.run (RunnableErrorForwarder.java:75) at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1130) at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:630) at java.lang.Thread.run (Thread.java:832)[WARNING] Checksum validation failed, expected <!doctype but is 18420d7f1430a348837b97a31a80e374e3b00254 from maven-default-http-blocker for http://0.0.0.0/com/alibaba/nacos/nacos-client-mse-extension/1.4.2-SNAPSHOT/maven-metadata.xmlDownloaded from maven-default-http-blocker: http://0.0.0.0/com/alibaba/nacos/nacos-client-mse-extension/1.4.2-SNAPSHOT/maven-metadata.xml (63 kB at 19 kB/s)
复制代码
从关键字 maven-default-http-blocker 可以找到相关资料。
简而言之，如果使用 HTTP 协议下载依赖，可能会导致中间人攻击。比如，本来想下载一个 nacos-client 的，结果下载的结果中被插入了恶意代码，然后开发人员运行了一下，黑客就能获得开发人员的计算机控制权了。
所以 Maven 3.8.1 就禁止了所有 HTTP 协议的 Maven 仓库。
详情见Maven 3.8.1的发布日志。
问题是在日常开发中，我们经常会用到公司内部的 maven 仓库。这些仓库一般都是 http 协议，Maven 3.8.1 禁止了 http 协议，那么就会导致开头的报错。
于是查了下，可以按照如下方式关闭：
修改全局的 settings.xml 文件（一般在系统路径下，比如 macOS 就在/usr/local/Cellar/maven/3.8.1/libexec/conf/pom.xml、/usr/local/Cellar/maven/3.8.2/libexec/conf/settings.xml）,删除如下部分即可：
<mirror> <id>maven-default-http-blocker</id> <mirrorOf>external:http:*</mirrorOf> <name>Pseudo repository to mirror external repositories initially using HTTP.</name> <url>http://0.0.0.0/</url> <blocked>true</blocked></mirror>
复制代码
然后就可以继续正常使用 Maven 了。
P.S. 对于外部仓库，还是建议使用 HTTPS 协议访问，防止出现针对性的中间人攻击。
评论