Artifact Server HTTPS Only Annoucements.md

Artifact Server Annoucements

This document captures the links to all of the different artifact server hosts that have announced they will be formally depricating downloading dependencies over HTTP and will only be supporting HTTPS starting in January 2020.

Want to take over the Java ecosystem? All you need is a MITM!

Maven Sonatype

Timeline:

• HTTP disabled January 15th, 2020

Announcement:

• https://central.sonatype.org/articles/2019/Apr/30/http-access-to-repo1mavenorg-and-repomavenapacheorg-is-being-deprecated/

JFrog JCenter

Timeline:

• October 1st, 2019: HTTP -> HTTPS redirect
• January 13st, 2020: HTTP disabled

Annoucement:

• https://jfrog.com/blog/secure-jcenter-with-https/

Pivotal/Spring

Timeline:

• January 15th, 2020: HTTP disabled

Annoucement:

• https://spring.io/blog/2019/09/16/goodbye-http-repo-spring-use-https

Gradle

Timeline:

• October 29th, 2019: HTTP to HTTPS redirect.
• November 14th, 2019: Disable HTTP for 24 hours and permanently drop support for TLSv1
• January 15th, 2020: HTTP requests to Gradle resources will be denied. Only HTTPS will be supported.
• February 15th, 2020: Enable HSTS for gradle.com and gradle.org. This change will only impact browsers.

Annoucement:

• https://blog.gradle.org/decommissioning-http

Eclipse Foundation

Plans: https://bugs.eclipse.org/bugs/show_bug.cgi?id=550999

---

Please star and subscribe to this gist for updates!