Issue when running behind Nginx Reverse Proxy

[ricardofalcao]

Hello, I was trying the repository manager and for the most part everything seems pretty fine, but when I tried using with the Nginx reverse proxy everything worked but the files could not be retrieved. Seems like the server interpreted the request as a folder instead of giving me the raw file:

My current nginx settings are the following:

location / {
         proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP  $remote_addr;
         proxy_pass              http://localhost:9090/;
}

Thanks again for the project, and I will try to investigate the issue myself too.

[dzikoysk]

Hey, thanks 👋

Reposilite also displays this page if the requested file is not found. The error might be a result of modified uri, could you make a request to this metadata file, but with /api prefix? domain.com/api/{metadata path} :)

[ricardofalcao]

Hey, it returns the following:

{
   "type":"file",
   "name":"maven-metadata.xml",
   "contentLength":609
}

[dzikoysk]

Could you display the value of window.REPOSILITE_MESSAGE using a DevTools console?

[ricardofalcao]

"Authorization credentials are not specified"

It seems that I forgot that I had enabled authentication, so it makes sense that I could not access it through the web interface, although I can list every folder and repository. But when I try to compile a maven project with a dependency from the repository (with authentication set up in the settings.xml), it says that the artifact was not found:

Could not resolve dependencies for project org.github.paperspigot:paperspigot-api:jar:1.8.8-R0.1-SNAPSHOT: Could not find artifact io.github.waterfallmc:olimpo-chat:jar:1.14-SNAPSHOT in cubeland-repo

[dzikoysk]

The security issue related to the lack of auth process for /api requests is already resolved and will be available in 2.5.1

Are you sure that the olimpo-chat:jar:1.14-SNAPSHOT builds located in snapshots repository contains required by Maven protocol information? Here is an example: https://repo.panda-lang.org/snapshots/org/panda-lang/nanomaven/2.1.2-SNAPSHOT

[ricardofalcao]

Great to hear. Although I find that it is not the right way to use it, I usually also put my snapshot version on the releases repository, because it is a private repository. Still, I tried to move everything to the snapshots repository, but nothing changed, the artifact still could not be found. I also tried to disable the authentication, but also nothing changed. I have double-checked that the files are present in the repository.

[dzikoysk]

Could you run your maven build with enabled debug (-X). You should be able to see full response from reposilite.

Well, if you are not using the proper SNAPSHOT releases, you should keep them in your releases repository as you did it before. Anyway, it should work fine as far as everything is set correctly:

https://repo.panda-lang.org/releases/org/bukkit/craftbukkit

[ricardofalcao]

I have attached the output log:
output.txt

[dzikoysk]

Could you try 2.5.1? https://repo.panda-lang.org/org/panda-lang/reposilite/2.5.1/reposilite-2.5.1.jar
You should be able to see some errors during the build process

[ricardofalcao]

I have uploaded the log: https://pastebin.com/kMi7GQzZ
It seems to not be able to find the maven metadata file for the olimpo-parent artifact although in the picture below it clearly exists the specified file:

[dzikoysk]

Reposilite does not use local metadata files anyway, so it doesn't matter.

Ok, well... the problem is that because of the -SNAPSHOT modifier, Maven requests groupId/artifactId/version/maven-metadata.xml file which is unsupported for standard repositories (metadata file for these repos is located in artifact directory). It's not a bug, because Maven specification does not provide the possibility of snapshot releases in standard repositories. I've marked it as an enhancement request.

I'll probably implement it in 2-4 days, because I'm a little bussy at this moment. As a workaround you can just temporarily remove the -SNAPSHOT modifier.

[ricardofalcao]

Thank you very much, take your time!

[dzikoysk]

Could you try to use https://repo.panda-lang.org/org/panda-lang/reposilite/2.5.2/reposilite-2.5.2.jar? It generates fake metadata file for this kind of requests, maybe that's enough.

[ricardofalcao]

It seems to be working, great! Although when my project fetches the dependencies it gives a warning saying that Checksum validation failed on the maven-metadata.xml. That might not be related to the recent changes because I seem to remember seeing those warnings in the 2.5.0 release. Is this a known issue?

[dzikoysk]

Checksum validation always fails, because Reposilite doesn't trust the metadata files offered by client - its generated by server, based on the repository content to ensure consistency. It's fine and it does not affect your builds.

[dzikoysk]

I've released official 2.5.2, it contains some changes comparing to the version above.

https://github.com/dzikoysk/reposilite/releases