Maven and Gradle

Route Maven through the Package Firewall with a settings.xml mirror, and declare the same repository for Gradle, which ignores settings.xml.


Repository URL	`https://packages.vulnetix.com/maven/`
Ecosystem ID	`maven`
Plan	Add-on
Mode	filter: blocked versions are removed from `maven-metadata.xml`
Cooldown	no (Maven metadata has no publish time)
Default mirror	`https://repo1.maven.org/maven2`

Curation entries and namespace entries use groupId:artifactId, for example com.acme:core or com.acme:*.

Automatic setup (Maven)

vulnetix package-firewall maven

This replaces ~/.m2/settings.xml with the file below. An existing settings.xml is first copied to ~/.m2/settings.xml.vulnetix.bak, and vulnetix package-firewall uninstall maven restores it.

<?xml version="1.0" encoding="UTF-8"?>
<settings>
  <servers>
    <server>
      <id>vulnetix-package-firewall</id>
      <username>YOUR_ORG_UUID</username>
      <password>YOUR_API_KEY</password>
    </server>
  </servers>
  <mirrors>
    <mirror>
      <id>vulnetix-package-firewall</id>
      <mirrorOf>*</mirrorOf>
      <url>https://packages.vulnetix.com/maven/</url>
    </mirror>
  </mirrors>
</settings>

<mirrorOf>*</mirrorOf> sends every repository through the firewall. Use *,!internal-repo to let one repository bypass it.

Gradle

Gradle does not read settings.xml. Declare the firewall in settings.gradle.kts and keep the credentials in ~/.gradle/gradle.properties:

// settings.gradle.kts
dependencyResolutionManagement {
    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
    repositories {
        maven {
            name = "vulnetix"
            url = uri("https://packages.vulnetix.com/maven/")
            credentials(PasswordCredentials::class)
        }
    }
}

# ~/.gradle/gradle.properties
vulnetixUsername=YOUR_ORG_UUID
vulnetixPassword=YOUR_API_KEY

credentials(PasswordCredentials::class) reads <name>Username and <name>Password. FAIL_ON_PROJECT_REPOS stops a module’s own mavenCentral() from going around the firewall. Plugins resolve from pluginManagement.repositories; add the same maven { } block there to cover them.

Use and verify

mvn help:effective-settings
mvn dependency:resolve
./gradlew dependencies --refresh-dependencies