nexus started limiting requests count (https://help.sonatype.com/en/sonatype-nexus-repository-3-87-0-release-notes.html) and in the same time they count incorret credentials requests (https://github.com/sonatype/nexus-public/issues/736), in my case i see that gradle is not failing and sending thousands of requests to private nexus after password change. So how to tell gradle to fail on first wrong credential request? It silently ignore it and continue build. (not just add task that will do HEAD request on each build first and not post dependency resolution).

that gradle is not failing and sending thousands of requests

I don't think Gradle does more than 3 requests before it gives up and fails. How are you seeing thousands of requests?

hmm i guess that could happen if you define multiple repos and gradle is supposed to get its artifact from the first repo and only fall back to the second repo if the matching artifact is not found in the first repo. If artifacts are not found in the first repo (or the permissions/credentials dont work out) but can be found in the second repo, than gradle still needs to query the first repo "first" for every other artifact. (?) I think that would be the correct and expected behavior, but doesn't play nicely with arbitrary licencing rules...

No, the only case when Gradle asks the next repo is, if a repo answered with "404 not found". Everything else aborts. Otherwise you could e.g. have changed credentials or missing VPN or temporary outage or whatever and suddenly resolve dependencies from a different repository, maybe one that was infected with malicious artifacts while DDoSing the primary repository. Besides that, when following best-practices, it does not matter much anyways, because then you should have repository content rules that define what is taken from where if you have multiple repositories defined. Thousands of requests is probably if you have thousands of dependencies, because even if the first fails, I think the others would also be tried.

ahem that intresting...

repositories {
    maven("<http://blub/>")
    mavenCentral()
}

dependencies {
    testImplementation(platform("org.junit:junit-bom:5.10.0"))
    testImplementation("org.junit.jupiter:junit-jupiter")
    testRuntimeOnly("org.junit.platform:junit-platform-launcher")
}

now according to documentation this should fail because blub is nonsense and spoooookey security problem if someone where to register a blub repository. However gradlew test works just fine...

You don't have any test sources. No test sources to compile, no need to resolve the test classpaths.

that would be embarissing but very possible

If I copy your snippet, it fails outright with complaining about insecure http, not resolving the dependencies from the other repo

you where faster than me

Then someone should report a bug I'd say

they call me someone man

Also, if it worked like documented, maybe the use-case of OP in this thread would be solved. Except if Gradle assumes that some artifacts might give 401 while others work.

https://github.com/gradle/gradle/issues/35927 we have a bugreport.. also cant wait for the bloodbath when dev-teams are at each other throats fighting for valuable requests :D

@Laura Kassovic counted requests/audit.log from nexus for incorrect_credentials. gradle -d

] Failed to get resource: GET. [HTTP HTTP/1.1 401 Unauthorized:

and continue looking into next repos. As much you run builds during the day as much limits consume in nexus. Persons just doesn't even know that there is issue with configuration. I know about limiting with include/exclude, but question is about failing build on 401. I didn't found the way to insert callback on http request processing.

@Kanstantsin Shautsou our working theory is that your build uses multiple repos (?) Is it possible to remove the non private repository or limit its usage? In that case gradle would actually fail fast if it can only download artifacts through your failing private issue and that repo doesnt work out

yes, there are multiple repos and i set includes/excludes now. I wrote here because ignoring 401 was a strange incsecure behaviour imho

https://docs.gradle.org/current/userguide/filtering_repository_content.html . This means that declaring that a repository includes an artifact doesn’t mean that the other repositories can’t have it either: you must declare what every repository contains in extension.

i call it usually "automagic" 🙂

😄

Thanks for filing the bug @TheGoesen

Was it fixed in 9.3.0?

As the issue is still Open, probably not

it was anounced that my micro using an illegal hostname was fixed, but about your issue using wrong permissions its a bit unclear

i see two sec fixed around repositories, but can't get wether it this case

Yes it was fixed, I just updated the issue. I also added all three of you to the two published advisories. Thanks for reporting this. Just as we said on the issue, err on the side of caution next time and follow the security report recommendation.

Could you add ability to set some user related callback verifier? for 404 cases i usually parse html for known errors