Skip to content

[Backport 2.19] Add Eclipse P2 mirror to avoid download.eclipse.org outages (security) - #6418

Merged
cwperks merged 1 commit into
opensearch-project:2.19from
peterzhuamazon:backport/backport-6391-to-2.19
Aug 21, 2026
Merged

[Backport 2.19] Add Eclipse P2 mirror to avoid download.eclipse.org outages (security)#6418
cwperks merged 1 commit into
opensearch-project:2.19from
peterzhuamazon:backport/backport-6391-to-2.19

Conversation

@peterzhuamazon

Copy link
Copy Markdown
Member

Description

Manual backport of #6391 to the 2.19 branch. Routes the Spotless Eclipse JDT formatter provisioning through the OpenSearch CI mirror (https://ci.opensearch.org/) instead of download.eclipse.org to avoid upstream outages/timeouts. Only the Eclipse P2 mirror one-liner is backported; any unrelated changes bundled in the original PR are not included.

Issues Resolved

Backport of #6391
opensearch-project/opensearch-build#6421

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@github-actions

Copy link
Copy Markdown
Contributor

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 66a7c74.

Hard block: Issues at High severity or above will block this PR from merging.

PathLineSeverityDescription
gradle/formatting.gradle17highBuild plugin package source URL redirected: Eclipse P2 repository downloads are redirected from the official 'https://download.eclipse.org/' to 'https://ci.opensearch.org/' via withP2Mirrors(). This is a build plugin/package source URL modification that must be flagged per mandatory rules. A compromised or attacker-controlled mirror at ci.opensearch.org could serve malicious Eclipse formatter plugins or other P2 artifacts, poisoning the build pipeline for all developers and CI runs.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 1 | Medium: 0 | Low: 0


Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.


⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

@cwperks
cwperks merged commit fb46909 into opensearch-project:2.19 Aug 21, 2026
141 of 153 checks passed
@github-project-automation github-project-automation Bot moved this from 👀 In Review to ✅ Done in Engineering Effectiveness Board Aug 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request release Project release skip-changelog

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

3 participants