How to set up plugin downloads over SSL? - sbt

Question

I have a SBT project that uses the sbt-start-script plugin. When I run SBT, the plugin jar is downloaded over unsecured HTTP instead of HTTPS:
downloading http://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/com.typesafe.sbt/sbt-start-script/scala_2.10/sbt_0.13/0.10.0/jars/sbt-start-script.jar ...
I want to use the https version of the repo instead (which I can browse to manually), but I can't figure out how get SBT to use it.
My project/plugins.sbt looks like this:
addSbtPlugin("com.typesafe.sbt" % "sbt-start-script" % "0.10.0")
I tried adding the https version to the SBT properties' [repositories] section and also tried adding it to the resolvers list, but SBT always uses the http version of the repo.
Does addSbtPlugin add the repo automatically?

Answer 1

tl;dr Create ~/.sbt/repositories with a https version or create a repositories file of different non-default name and run sbt with -Dsbt.override.build.repos=true and -Dsbt.repository.config=path-to-the-repositories-file.
Let's start with the default build definition - no additional setup but what comes with sbt itself.
show fullResolvers to know the external resolvers for automatically managed dependencies - there are three resolvers (formatting is mine to ease reading).
➜ https-repositories xsbt
...
> show fullResolvers
[info] ArrayBuffer(
Raw(ProjectResolver(inter-project, mapped: )),
FileRepository(local,FileConfiguration(true,None),Patterns(ivyPatterns=List(${ivy.home}/local/[organisation]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), artifactPatterns=List(${ivy.home}/local/[organisation]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), isMavenCompatible=false, descriptorOptional=false, skipConsistencyCheck=false)),
public: https://repo1.maven.org/maven2/)
Command Line Options says:
sbt.override.build.repos If true, repositories configured in a build definition are ignored and the repositories configured for the launcher are used instead. See sbt.repository.config and the sbt launcher documentation.
sbt.repository.config A file containing the repositories to use for the launcher. The format is the same as a [repositories] section for a sbt launcher configuration file. This setting is typically used in conjuction with setting sbt.override.build.repos to true (see previous row and the sbt launcher documentation).
That means that when sbt finds ~/.sbt/repositories with [repositories] inside they will become the resolvers for sbt.
Create ~/.sbt/repositories with the following content:
[repositories]
httpsInstead: https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/,[organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]
As you may have noticed, the file solely defines a https version of the repository in question.
reload the session (or start it over) and do show fullResolvers.
➜ https-repositories ls ~/.sbt/repositories
/Users/jacek/.sbt/repositories
➜ https-repositories xsbt
...
> show fullResolvers
[info] ArrayBuffer(
Raw(ProjectResolver(inter-project, mapped: )),
URLRepository(httpsInstead,Patterns(ivyPatterns=List(https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/[organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), artifactPatterns=List(https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/[organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), isMavenCompatible=false, descriptorOptional=false, skipConsistencyCheck=false)))
There are two resolvers now!
Let's use the sbt.* options - sbt.override.build.repos and sbt.repository.config.
➜ https-repositories ls ~/.sbt/my_repositories
/Users/jacek/.sbt/my_repositories
➜ https-repositories ls ~/.sbt/repositories*
zsh: no matches found: /Users/jacek/.sbt/repositories*
➜ https-repositories SBT_OPTS="-Dsbt.override.build.repos=false -Dsbt.repository.config=/Users/jacek/.sbt/my_repositories" xsbt
...
> show fullResolvers
[info] ArrayBuffer(
Raw(ProjectResolver(inter-project, mapped: )),
URLRepository(httpsInstead,Patterns(ivyPatterns=List(https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/[organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), artifactPatterns=List(https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/[organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), isMavenCompatible=false, descriptorOptional=false, skipConsistencyCheck=false)))
There are two resolvers again.
It appears that it doesn't change much with sbt.override.build.repos=true.
➜ https-repositories SBT_OPTS="-Dsbt.override.build.repos=true -Dsbt.repository.config=/Users/jacek/.sbt/my_repositories" xsbt
...
> show fullResolvers
[info] ArrayBuffer(
Raw(ProjectResolver(inter-project, mapped: )),
URLRepository(httpsInstead,Patterns(ivyPatterns=List(https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/[organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), artifactPatterns=List(https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/[organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), isMavenCompatible=false, descriptorOptional=false, skipConsistencyCheck=false)))
What's interesting is that with sbt.override.build.repos=true the resolvers change for sbt project builds.
This is a sample build.sbt with an imaginary repository:
resolvers += "build.sbt" at "http://my.repository.com"
The first session is with -Dsbt.override.build.repos=false:
➜ https-repositories SBT_OPTS="-Dsbt.override.build.repos=false -Dsbt.repository.config=/Users/jacek/.sbt/my_repositories" xsbt
...
> show fullResolvers
[info] ArrayBuffer(
Raw(ProjectResolver(inter-project, mapped: )),
URLRepository(httpsInstead,Patterns(ivyPatterns=List(https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/[organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), artifactPatterns=List(https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/[organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), isMavenCompatible=false, descriptorOptional=false, skipConsistencyCheck=false)),
build.sbt: http://my.repository.com)
Another session with -Dsbt.override.build.repos=true:
➜ https-repositories SBT_OPTS="-Dsbt.override.build.repos=true -Dsbt.repository.config=/Users/jacek/.sbt/my_repositories" xsbt
...
> show fullResolvers
[info] ArrayBuffer(
Raw(ProjectResolver(inter-project, mapped: )),
URLRepository(httpsInstead,Patterns(ivyPatterns=List(https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/[organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), artifactPatterns=List(https://repo.scala-sbt.org/scalasbt/sbt-plugin-releases/[organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]), isMavenCompatible=false, descriptorOptional=false, skipConsistencyCheck=false)))