upstream: b=master,r=8be2942c4424be5b2cb40d15cc316d8b9fd72d43,t=2016-…

…03-08-0448-45717

buildsupport/db/pom.xml

@@ -27,8 +27,13 @@
   <name>${project.groupId}:${project.artifactId}</name>
   <packaging>pom</packaging>
 
+  <properties>
+    <orientdb.version>2.1.8</orientdb.version>
+  </properties>
+
   <dependencyManagement>
     <dependencies>
+
       <dependency>
         <groupId>com.h2database</groupId>
         <artifactId>h2</artifactId>
@@ -52,6 +57,43 @@
         <artifactId>stringtemplate</artifactId>
         <version>3.0</version>
       </dependency>
+
+      <dependency>
+        <groupId>com.orientechnologies</groupId>
+        <artifactId>orientdb-core</artifactId>
+        <version>${orientdb.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.xerial.snappy</groupId>
+            <artifactId>snappy-java</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+
+      <dependency>
+        <groupId>com.orientechnologies</groupId>
+        <artifactId>orientdb-server</artifactId>
+        <version>${orientdb.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>javax.activation</groupId>
+            <artifactId>activation</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+
+      <dependency>
+        <groupId>com.orientechnologies</groupId>
+        <artifactId>orientdb-enterprise</artifactId>
+        <version>${orientdb.version}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>com.orientechnologies</groupId>
+        <artifactId>orientdb-client</artifactId>
+        <version>${orientdb.version}</version>
+      </dependency>
+
     </dependencies>
   </dependencyManagement>
 

buildsupport/insight/pom.xml

@@ -29,8 +29,8 @@
 
   <properties>
     <sonatype-licensing.version>1.4</sonatype-licensing.version>
-    <insight-brain.version>1.19.0-SNAPSHOT</insight-brain.version>
-    <insight-scanner.version>2.3.2-SNAPSHOT</insight-scanner.version>
+    <insight-brain.version>1.20.0-SNAPSHOT</insight-brain.version>
+    <insight-scanner.version>2.3.2</insight-scanner.version>
   </properties>
 
   <dependencyManagement>

buildsupport/rest/pom.xml

@@ -141,6 +141,18 @@
         <version>${jackson.version}</version>
       </dependency>
 
+      <dependency>
+        <groupId>com.fasterxml.jackson.dataformat</groupId>
+        <artifactId>jackson-dataformat-smile</artifactId>
+        <version>${jackson.version}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>com.fasterxml.jackson.jaxrs</groupId>
+        <artifactId>jackson-jaxrs-smile-provider</artifactId>
+        <version>${jackson2.version}</version>
+      </dependency>
+
     </dependencies>
   </dependencyManagement>
 

components/nexus-client-core/src/main/java/org/sonatype/nexus/client/internal/rest/jersey/subsystem/JerseyArtifactMaven.java

@@ -47,7 +47,7 @@ public ResolveResponse resolve(final ResolveRequest req) {
     queryParams.add("a", req.getArtifactId());
     queryParams.add("v", req.getVersion());
     if (req.getPackaging() != null) {
-      queryParams.add("p", req.getVersion());
+      queryParams.add("p", req.getPackaging());
     }
     if (req.getClassifier() != null) {
       queryParams.add("c", req.getClassifier());

components/nexus-core/src/main/java/org/sonatype/nexus/NxApplication.java

@@ -20,6 +20,7 @@
 
 import javax.inject.Inject;
 import javax.inject.Named;
+import javax.inject.Provider;
 import javax.inject.Singleton;
 
 import org.sonatype.configuration.ConfigurationException;
@@ -38,6 +39,7 @@
 import org.sonatype.nexus.tasks.SynchronizeShadowsTask;
 import org.sonatype.security.SecuritySystem;
 import org.sonatype.sisu.goodies.eventbus.EventBus;
+import org.sonatype.sisu.goodies.lifecycle.Lifecycle;
 import org.sonatype.sisu.goodies.lifecycle.LifecycleSupport;
 
 import com.google.common.annotations.VisibleForTesting;
@@ -73,11 +75,14 @@ public class NxApplication
 
   private final EventSubscriberHost eventSubscriberHost;
 
+  private final Provider<Lifecycle> orientBootstrap;
+
   @Inject
   public NxApplication(final EventBus eventBus, final NexusConfiguration nexusConfiguration,
       final NexusPluginManager nexusPluginManager, final ApplicationStatusSource applicationStatusSource,
       final SecuritySystem securitySystem, final NexusScheduler nexusScheduler,
-      final RepositoryRegistry repositoryRegistry, final EventSubscriberHost eventSubscriberHost)
+      final RepositoryRegistry repositoryRegistry, final EventSubscriberHost eventSubscriberHost,
+      @Named("orient-bootstrap") final Provider<Lifecycle> orientBootstrap)
   {
     this.eventBus = checkNotNull(eventBus);
     this.applicationStatusSource = checkNotNull(applicationStatusSource);
@@ -87,6 +92,7 @@ public NxApplication(final EventBus eventBus, final NexusConfiguration nexusConf
     this.nexusScheduler = checkNotNull(nexusScheduler);
     this.repositoryRegistry = checkNotNull(repositoryRegistry);
     this.eventSubscriberHost = checkNotNull(eventSubscriberHost);
+    this.orientBootstrap = checkNotNull(orientBootstrap);
 
     logInitialized();
 
@@ -122,6 +128,7 @@ protected void logInitialized() {
   protected final String getNexusNameForLogs() {
     final StringBuilder msg = new StringBuilder();
     msg.append(applicationStatusSource.getSystemStatus().getAppName());
+    msg.append(" ").append(applicationStatusSource.getSystemStatus().getEditionShort());
     msg.append(" ").append(applicationStatusSource.getSystemStatus().getVersion());
     return msg.toString();
   }
@@ -130,6 +137,20 @@ protected final String getNexusNameForLogs() {
   protected void doStart() {
     applicationStatusSource.getSystemStatus().setState(SystemState.STARTING);
     try {
+      // HACK: bootstrap orient services right away, before nexus-configuration loads
+      try {
+        Lifecycle orientLifecycle = orientBootstrap.get();
+        if (orientLifecycle != null) {
+          orientLifecycle.start();
+        }
+        else {
+          log.warn("Orient services are not installed");
+        }
+      }
+      catch (Exception e) {
+        log.error("Failed to start Orient services", e);
+      }
+
       // force configuration load, validation and probable upgrade if needed
       // applies configuration and notifies listeners
       nexusConfiguration.loadConfiguration(true);
@@ -198,12 +219,26 @@ protected void doStop() {
 
     // Due to no dependency mechanism in NX for components, we need to fire off a hint about shutdown first
     eventBus.post(new NexusStoppingEvent(this));
+
     // kill services + notify
     nexusScheduler.shutdown();
     eventBus.post(new NexusStoppedEvent(this));
+
     eventSubscriberHost.shutdown();
     nexusConfiguration.dropInternals();
     securitySystem.stop();
+
+    // HACK: shutdown orient services
+    try {
+      Lifecycle orientLifecycle = orientBootstrap.get();
+      if (orientLifecycle != null) {
+        orientLifecycle.stop();
+      }
+    }
+    catch (Exception e) {
+      log.error("Failed to stop Orient services", e);
+    }
+
     applicationStatusSource.getSystemStatus().setState(SystemState.STOPPED);
     log.info("Stopped {}", getNexusNameForLogs());
   }

components/nexus-core/src/main/java/org/sonatype/nexus/configuration/application/RepositoryDependentException.java

@@ -29,7 +29,7 @@ public class RepositoryDependentException
   private final Repository repository;
 
   public RepositoryDependentException(Repository repository, Repository dependant) {
-    super(format("Repository %s cannot be deleted due to dependency: repository %s.",
+    super(format("Repository %s cannot be deleted due to dependant repository %s.",
         getHumanizedNameString(repository), getHumanizedNameString(dependant)));
     this.repository = repository;
     this.dependant = dependant;
@@ -45,7 +45,7 @@ public Repository getRepository() {
 
   public String getUIMessage() {
     return format(
-        "Repository '%s' cannot be deleted due to dependencies on repository '%s'.\nDependencies must be removed in order to complete this operation.",
+        "Repository '%s' cannot be deleted due to dependant repository '%s'.\nDependencies must be removed in order to complete this operation.",
         getHumanizedNameString(repository), getHumanizedNameString(dependant));
   }
 

components/nexus-core/src/main/java/org/sonatype/nexus/proxy/item/uid/CoreRepositoryItemUidAttributeSource.java

@@ -34,6 +34,7 @@ public class CoreRepositoryItemUidAttributeSource
   public CoreRepositoryItemUidAttributeSource() {
     Map<Class<?>, Attribute<?>> attrs = new HashMap<Class<?>, Attribute<?>>(2);
 
+    attrs.put(IsInternalAttribute.class, new IsInternalAttribute());
     attrs.put(IsMetacontentAttribute.class, new IsMetacontentAttribute());
     attrs.put(IsTrashMetacontentAttribute.class, new IsTrashMetacontentAttribute());
     attrs.put(IsItemAttributeMetacontentAttribute.class, new IsItemAttributeMetacontentAttribute());

components/nexus-core/src/main/java/org/sonatype/nexus/proxy/item/uid/IsInternalAttribute.java

@@ -0,0 +1,30 @@
+/*
+ * Sonatype Nexus (TM) Open Source Version
+ * Copyright (c) 2008-present Sonatype, Inc.
+ * All rights reserved. Includes the third-party code listed at http://links.sonatype.com/products/nexus/oss/attributions.
+ *
+ * This program and the accompanying materials are made available under the terms of the Eclipse Public License Version 1.0,
+ * which accompanies this distribution and is available at http://www.eclipse.org/legal/epl-v10.html.
+ *
+ * Sonatype Nexus (TM) Professional Version is available from Sonatype, Inc. "Sonatype" and "Sonatype Nexus" are trademarks
+ * of Sonatype, Inc. Apache Maven is a trademark of the Apache Software Foundation. M2eclipse is a trademark of the
+ * Eclipse Foundation. All other trademarks are the property of their respective owners.
+ */
+package org.sonatype.nexus.proxy.item.uid;
+
+import org.sonatype.nexus.proxy.item.RepositoryItemUid;
+
+/**
+ * Repository-item UID-attribute indicating if item is internal.
+ *
+ * @since 2.13
+ */
+public class IsInternalAttribute
+    implements Attribute<Boolean>
+{
+  @Override
+  public Boolean getValueFor(final RepositoryItemUid subject) {
+    String path = subject.getPath();
+    return path != null && path.startsWith("/.nexus");
+  }
+}

components/nexus-core/src/main/java/org/sonatype/nexus/proxy/maven/maven2/M2GroupRepository.java

@@ -326,6 +326,7 @@ protected void storeMergedMetadataItemDigest(ResourceStoreRequest request, Strin
     ResourceStoreRequest req = new ResourceStoreRequest(digestFileName);
 
     req.getRequestContext().setParentContext(request.getRequestContext());
+    req.getRequestContext().setRequestIsExternal(false); // override in THIS context possible TRUE from parent
 
     // Metadata checksum files are not composite ones, they are derivatives of the Metadata (and metadata file _is_
     // composite one)

components/nexus-core/src/main/java/org/sonatype/nexus/proxy/repository/AbstractRepository.java

@@ -997,6 +997,10 @@ public void storeItem(boolean fromTask, StorageItem item)
     final Action action = getResultingActionOnWrite(item.getResourceStoreRequest());
 
     try {
+      if (item.getResourceStoreRequest().isExternal()) {
+        enforceWritePolicy(item.getResourceStoreRequest(), action); // 2nd check within exclusive lock
+      }
+
       // NEXUS-4550: we are shared-locking the actual UID (to not prevent downloaders while
       // we save to temporary location. But this depends on actual LS backend actually...)
       // but we exclusive lock uploaders to serialize them!

components/nexus-core/src/main/java/org/sonatype/nexus/proxy/wastebasket/AbstractRepositoryFolderCleaner.java

@@ -14,6 +14,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Path;
 
 import javax.inject.Inject;
 
@@ -47,11 +48,19 @@ protected ApplicationConfiguration getApplicationConfiguration() {
   protected void delete(final File file, final boolean deleteForever)
       throws IOException
   {
-    File basketFile =
-        new File(getApplicationConfiguration().getWorkingDirectory(GLOBAL_TRASH_KEY), file.getName());
+    Path basketPath =
+        new File(getApplicationConfiguration().getWorkingDirectory(GLOBAL_TRASH_KEY), file.getName()).toPath();
     if (!deleteForever) {
+      // if trash already has this named path (whatever is), rename it
+      DirSupport.moveIfExists(
+          basketPath,
+          basketPath.getParent().resolve(file.getName() + "__" + System.currentTimeMillis())
+      );
       // move to trash
-      DirSupport.moveIfExists(file.toPath(), basketFile.toPath());
+      DirSupport.moveIfExists(
+          file.toPath(),
+          basketPath
+      );
     }
     else {
       DirSupport.deleteIfExists(file.toPath());

components/nexus-core/src/main/java/org/sonatype/nexus/security/filter/authc/NexusHttpAuthenticationFilter.java

@@ -35,6 +35,7 @@
 
 import com.google.common.base.Throwables;
 import com.google.common.collect.ImmutableMap;
+import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.commons.lang.StringUtils;
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationToken;
@@ -313,7 +314,7 @@ private void postAuthcEvent(ServletRequest request, String username, String user
       eventBus.post(
           new NexusAuthenticationEvent(
               this,
-              new ClientInfo(username, RemoteIPFinder.findIP((HttpServletRequest) request), userAgent),
+              new ClientInfo(StringEscapeUtils.escapeHtml(username), RemoteIPFinder.findIP((HttpServletRequest) request), userAgent),
               success
           )
       );

components/nexus-core/src/main/java/org/sonatype/nexus/util/io/AutoClosableIterable.java

@@ -0,0 +1,57 @@
+/*
+ * Sonatype Nexus (TM) Open Source Version
+ * Copyright (c) 2008-present Sonatype, Inc.
+ * All rights reserved. Includes the third-party code listed at http://links.sonatype.com/products/nexus/oss/attributions.
+ *
+ * This program and the accompanying materials are made available under the terms of the Eclipse Public License Version 1.0,
+ * which accompanies this distribution and is available at http://www.eclipse.org/legal/epl-v10.html.
+ *
+ * Sonatype Nexus (TM) Professional Version is available from Sonatype, Inc. "Sonatype" and "Sonatype Nexus" are trademarks
+ * of Sonatype, Inc. Apache Maven is a trademark of the Apache Software Foundation. M2eclipse is a trademark of the
+ * Eclipse Foundation. All other trademarks are the property of their respective owners.
+ */
+package org.sonatype.nexus.util.io;
+
+import java.io.Closeable;
+import java.util.Collections;
+import java.util.Iterator;
+
+/**
+ * {@link AutoCloseable} {@link Iterable}.
+ *
+ * @since 2.13
+ */
+public interface AutoClosableIterable<T>
+    extends Closeable, AutoCloseable, Iterable<T>
+{
+  /**
+   * Helper to create {@link AutoClosableIterable}.
+   */
+  class Factory
+  {
+    private Factory() {
+      // empty
+    }
+
+    private static final AutoClosableIterable EMPTY_ITERABLE = new AutoClosableIterable<Object>()
+    {
+      @Override
+      public void close() {
+        // empty
+      }
+
+      @Override
+      public Iterator<Object> iterator() {
+        return Collections.emptyIterator();
+      }
+    };
+
+    /**
+     * Create empty/nop iterable.
+     */
+    @SuppressWarnings("unchecked")
+    public static <T> AutoClosableIterable<T> emptyIterable() {
+      return EMPTY_ITERABLE;
+    }
+  }
+}