maven-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Chris Povirk (JIRA)" <>
Subject [jira] [Commented] (MJAVADOC-507) -linkoffline rejects valid package-list files because of SSL problems
Date Thu, 01 Feb 2018 20:22:02 GMT


Chris Povirk commented on MJAVADOC-507:

I haven't investigated again in detail, but I'm now seeing an error like this for an {{offlineLink}}
to the JDK itself:

{{[ERROR] Error fetching link: Ignored

Since I can load that file fine in my browser, I suspect this bug. (If so, it may at least
go away for now when I upgrade to Java 9.)

> -linkoffline rejects valid package-list files because of SSL problems
> ---------------------------------------------------------------------
>                 Key: MJAVADOC-507
>                 URL:
>             Project: Maven Javadoc Plugin
>          Issue Type: Bug
>          Components: javadoc
>    Affects Versions: 3.0.0
>         Environment: Java 8
>            Reporter: Chris Povirk
>            Priority: Minor
> For weird reasons, we're trying to use <offlineLinks> rather than <links>
for some of our links. Our configuration includes:
> {code:xml}            <offlineLink>
>               <url></url>
>               <location></location>
>             </offlineLink>{code}
> If I run javadoc with -linkoffline set to this URL and location, I get links in the resulting
docs. However, if I run maven-javadoc-plugin, I get an error:
> {noformat}[ERROR] Error fetching link:
Ignored it.{noformat}
> Since javadoc can load the package-list fine and so can my browser, there seems to be
something wrong in maven-javadoc-plugin. To debug, I built my own maven-javadoc-plugin, modified
to display the full error that caused the failure. It showed this:
> {noformat} Certificate for <> doesn't
match any of the subject alternative names: [*]
>         at org.apache.http.conn.ssl.AbstractVerifier.verify(
>         at org.apache.http.conn.ssl.BrowserCompatHostnameVerifier.verify(
>         at org.apache.http.conn.ssl.AbstractVerifier.verify(
>         at org.apache.http.conn.ssl.AbstractVerifier.verify(
>         at org.apache.http.conn.ssl.SSLSocketFactory.verifyHostname(
>         at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(
>         at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(
>         at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(
>         at
>         at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(
>         at org.apache.http.impl.client.DefaultRequestDirector.execute(
>         at org.apache.http.impl.client.AbstractHttpClient.doExecute(
>         at org.apache.http.impl.client.CloseableHttpClient.execute(
>         at org.apache.http.impl.client.CloseableHttpClient.execute(
>         at org.apache.http.impl.client.CloseableHttpClient.execute(
>         at org.apache.maven.plugins.javadoc.JavadocUtil.isValidPackageList({noformat}
> Now, I *don't* see this error if I run with Java 9. This suggests to me that each copy
of Java has its own certificate list/logic. That means that the problem isn't in maven-javadoc-plugin
per se.
> However, it seems inevitable that the built-in Java list will go out of date again, and
maven-javadoc-plugin will fail again for some other site.
> One solution would be for maven-javadoc-plugin to do whatever it is that Javadoc itself
does to recognize more certificates. However, this sounds complicated.
> The simple solution would be for maven-javadoc-plugin to stop pre-validating package-list
files altogether (since Javadoc will ignore them if they're truly missing). But, if you want
to keep the validation, then I'd suggest passing all URLs to Javadoc, even the ones that fail
validation. That way, users still get a loud, red/yellow Maven error/warning for real problems,
but false problems like the one here don't keep Javadoc links from working.

This message was sent by Atlassian JIRA

View raw message