Please don't use insecure repositories

[argv-minus-one]

As of 8130aca, the build and generated POM use external repositories that are accessed by plain HTTP, not HTTP+TLS (https scheme). This exposes everyone who uses or builds this project (including you!) to man-in-the-middle attacks while downloading dependencies for it, injecting malicious code that runs with the full privileges of one's user account.

Please remove or replace these repositories as soon as possible.

[ndw]

Fails because maven.restlet.org has a bad cert. :-(

See https://travis-ci.org/ndw/xmlcalabash1/builds/348340392
and https://twitter.com/ndw/status/969634703656529925

[davidpriest]

For me, maven { url "https://maven.restlet.com" } works.

[ndw]

It works for me too, but Travis doesn't like it. They must be checking certificates more diligently.

  > Could not resolve org.restlet.jee:org.restlet:2.2.2.
     > Could not get resource 'https://maven.restlet.org/org/restlet/jee/org.restlet/2.2.2/org.restlet-2.2.2.pom'.
        > Could not GET 'https://maven.restlet.org/org/restlet/jee/org.restlet/2.2.2/org.restlet-2.2.2.pom'.
           > Host name 'maven.restlet.org' does not match the certificate subject provided by the peer (CN=restlet.com)

I guess rather than going back to an insecure repository I'll just put them in the project locally for the time being.

[ndw]

This appears to be resolved. I've got an https: link to restlet.org and it's working.