[BUG] "Consume insecure Maven repositories" feature in repository/maven tab is not working

[Neilhamza]

Is there an existing issue for this?

• I have searched the existing issues

Konveyor version

rc.0.3

Priority

Blocker

Current Behavior

enabling the feature (administrator/repositories/maven) ->Consume insecure Maven repositories
and then using an unsecured url for analysis (http) causes analysis to fail
currently only secured (https) urls are being analysed

Expected Behavior

after enabling the feature analysis should be completed successfully

How Reproducible

Always (Default)

Steps To Reproduce

No response

Environment

- OS:fedora9

Anything else?

[konveyor-ci-bot]

This issue is currently awaiting triage.
If contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.
The triage/accepted label can be added by org members.

[mansam]

I am not completely sure if this should be considered a Konveyor bug, although perhaps the option could be more clear. "Consume insecure Maven repositories" corresponds to a Maven setting to disable TLS certificate verification for HTTPS connections in order to facilitate using repositories that are protected by self-signed certificates.

Since version 3.8.1, Maven blocks HTTP connections and requires HTTPS unless given special configuration on a per-repository basis to circumvent the block. Since this is expected behavior from Maven, it seems reasonable to expect that the user should provide a Maven settings file with whatever configuration changes are necessary to access their HTTP repository.