From c37d4935c183d401a533084f36b39b72bb5b31f0 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Wed, 2 Sep 2026 00:57:06 +0200
Subject: [PATCH 1/2] Apply session authentication to descriptor repositories
 by provenance

DefaultModelResolver builds the models of artifact descriptors resolved
from repositories, so the repositories those models declare are remotely
supplied input. Pass them to the resolver's aggregateRepositories
overload (maven-resolver 1.9.28, apache/maven-resolver#2092) flagged as
descriptor-declared, so session authentication matched by repository id
is applied to them only when an operator-defined mirror captures them.
Repositories supplied by the build itself are unaffected.
---
 .../maven/repository/internal/DefaultModelResolver.java    | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/DefaultModelResolver.java b/maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/DefaultModelResolver.java
index 4dc86735a1fb..73e99bf37843 100644
--- a/maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/DefaultModelResolver.java
+++ b/maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/DefaultModelResolver.java
@@ -144,7 +144,12 @@ public void addRepository(final Repository repository, boolean replace) throws I
         List<RemoteRepository> newRepositories =
                 Collections.singletonList(ArtifactDescriptorUtils.toRemoteRepository(repository));
 
-        this.repositories = remoteRepositoryManager.aggregateRepositories(session, repositories, newRepositories, true);
+        // The model being built is an artifact descriptor resolved from a repository, so the
+        // repositories it declares are remotely supplied input: they are merged recessively and
+        // flagged as descriptor-declared, which lets the repository manager withhold session
+        // authentication from them unless an operator-defined mirror captures them.
+        this.repositories =
+                remoteRepositoryManager.aggregateRepositories(session, repositories, newRepositories, true, true);
     }
 
     private static void removeMatchingRepository(Iterable<RemoteRepository> repositories, final String id) {

From 930a23702a92fcd10ad8932c467497a039457504 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Wed, 2 Sep 2026 00:57:06 +0200
Subject: [PATCH 2/2] Build aid, do not merge: depend on maven-resolver
 1.9.28-SNAPSHOT

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 83020529269f..5d89ee53b4e4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -144,7 +144,7 @@ under the License.
     <!-- plexus-cipher 2.1.0 uses an incompatible KDF; ciphertext encrypted with 2.0 will no longer decrypt — see #12811. Do not bump on this branch. -->
     <cipherVersion>2.0</cipherVersion>
     <jxpathVersion>1.4.0</jxpathVersion>
-    <resolverVersion>1.9.27</resolverVersion>
+    <resolverVersion>1.9.28-SNAPSHOT</resolverVersion>
     <slf4jVersion>1.7.36</slf4jVersion>
     <xmlunitVersion>2.13.0</xmlunitVersion>
     <powermockVersion>2.0.9</powermockVersion>