fix(oss-index)!: Rework OSS Index authentication #10866
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #10866 +/- ##
=========================================
Coverage 57.53% 57.53%
Complexity 1698 1698
=========================================
Files 346 346
Lines 12823 12823
Branches 1212 1212
=========================================
Hits 7378 7378
Misses 4978 4978
Partials 467 467
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
|
||
| private val getComponentReport by lazy { | ||
| val hasCredentials = config.username != null && config.password != null | ||
| val hasCredentials = config.username.isNotEmpty() && config.token.value.isNotEmpty() |
There was a problem hiding this comment.
Is this if/else still valid? Or is service::getComponentReport, which I assume is "unauthenticated", now invalid (and should be removed) ?
There was a problem hiding this comment.
Note: The hasCredentials check could be "inlined" and moved before the forEach loop in retrievePackageFindings() IIUC.
There was a problem hiding this comment.
I've moved removed the unauthenticated endpoint from the OSS Index client completely and adjusted the code accordingly.
As of September 22nd, 2025, authentication will be mandatory, see [1]. Reflect that by making respective properties non-nullable. While at it, also make the `username` a non-`Secret` and use a more fitting `token` property name. While at it also remove the unauthenticated endpoint from the OSS Index client implementation completely. BREAKING CHANGE: Users need to move their configured `username` property from the `secrets` to the `options` section, and rename the `password` property to `token` in the `secrets` section. [1]: https://ossindex.sonatype.org/doc/auth-required Signed-off-by: Sebastian Schuberth <[email protected]>
sschuberth
force-pushed
the
oss-index-auth
branch
from
5e31cb9 to
f83aed1
Compare
As of September 22nd, 2025, authentication will be mandatory, see 1. Reflect that by making respective properties non-nullable. While at it, also make the
usernamea non-Secretand use a more fittingtokenproperty.BREAKING CHANGE: Users need to move their configured
usernameproperty from thesecretsto theoptionssection, and rename thepasswordproperty in thesecretssection totoken.