Maven 3.9 resolver ignores proxy authentification system properties proxyUser and proxyPassword

[npen]

Affected version

3.9.16

Bug description

Following issue #997 resolution, it is possible to use aether.connector.http.useSystemProperties=true to allow the use of proxyHost and proxyPort system properties.

However, the call to setDefaultCredentialsProvider which happens just before will lead to completely ignore the related authentication properties https.proxyUser and https.proxyPassword.

I know using system properties is discouraged, here is my use-case:

Running Claude Code in sandboxed mode on MacOS X, command run by Claude has to go through a proxy whose parameters (host, port, user and password) are available in environment variable HTTPS_PROXY. It's worth to note that those parameters are not fixed and change on every sessions.

In the end, Claude ends up debugging maven commands, and duplicate settings.xml with proxy config added, and additional parameters to mvn commands.

I tried to setup a simple .mavenrc file to declare correct MAVEN_OPTS dynamically based on HTTPS_PROXY variable. This works fine, except that https.proxyUser and https.proxyPassword are completely ignored, leading to HTTP 407 errors.

[cstamas]

Maven 3.x versions use Resolver 1.x lineage (and 3.10 and above use Resolver 2.x lineage). Please specify which exactly Maven 3.9.? version is affected (or is all like [3.9.0,3.10.0))? Thanks

[npen]

Sorry, this is Maven 3.9.16, so I guess it's Resolver 1.x lineage.

[goutamadwant]

@gnodet I reproduced the HTTP 407 failure on both current master and Resolver 1.9.x and prepared corresponding fixes:

#2148
#2149

They honor matching system proxy credentials under the existing opt-in, preserve explicit Resolver authentication, and keep proxy credentials separate from repository authentication. Redirects that change proxy or become direct clear the system-derived proxy credentials. Let me know if you have any comments / suggestions. thanks!