Maven from Artifactory Virtual Repository

[EvertonSA]

hi colleagues, please correct me if i'm wrong, but if I understood correctly, renovate is not capable of using artifactory maven virtual repositories to fetch for newer dependencies if settings.xml does not exists on repository.

My settings.xml is not present in the repository, but injected in pipeline time. This works great in my case where I need to maintain 1 settings.xml for many different repositories. When trying renovatebot to update dependencies I'm always getting this error: Dependency lookup unauthorized. Please add authentication with a hostRule ... even though config.js has the correct token.

I managed to get renovate to fetch from private registry by setting registryUrls to the maven virtual repo, and I confirmed in renovate debug logs that is trying to fetch from correct URL, but still fails with authentication even with matchHost + token.

I understood from this issue that renovate does not work when settings.xml is not present, #13925, is my assumption correct?

content of config.js in repository were pom.xml exists:

module.exports = {
  hostRules: [
    {
      hostType: 'maven',
      matchHost: 'https://artifactory-something.com/artifactory/team-something-maven/',
      token: process.env.ARTIFACTORY_TOKEN
    },
  ],
  packageRules: [
    {
      matchDatasources: ['maven'],
      registryUrls: ['https://artifactory-something.com/artifactory/team-something-maven/'],
    },
  ],
};

logs:

[Shegox]

Not sure if that helps you, but we use following packageRules/hostRules for lookup with JFrog Artifactory. Notice that we use authType: Basic and username and pasword (the API key as password). Additionally we only use /build.releases directly without the additional /artifactory/ in the URL path.

{
  "hostRules": [
    {
      "hostType": "maven",
      "matchHost": "https://artifactory-something.com/build.releases",
      "username": "$ARTIFACTORY_USER",
      "password": "$ARTIFACTORY_API_KEY",
      "authType": "Basic"
    }
  ],
  "packageRules": [
    {
      "matchManagers": [
        "maven"
      ],
      "registryUrls": [
        "https://artifactory-something.com/build.releases"
      ]
    }
  ]
}        

[EvertonSA]

thanks for the input, do you have a settings.xml on your pom repositories?

[EvertonSA]

@Chumper I know it sucks being tagged by maven newbie users, but any help is appreciated. Do you know is not having settings.xml for can be an issue? My usecase is, no matter what, we should always fetch from artifactory, never from internet. The global settings.xml I have in pipeline time does that and it uses a custom id instead of central.

[Chumper]

Afaik you will not be able to get of maven as default mirror.
I had a few PRs ready but they were not fleshed out enough to solve this problem.

[EvertonSA]

as for reference, at the current state of this project, you will not be able to use renovate to pull pom dependencies from artifactory if your settings is external to the repo. meaning air gapped environments have to rely on proxy or change settings.xml strategy.