Is it possible to remove/change "-Dbloop.export-jar-classifiers=sources" parameter in bloopInstall?

[ddurnev]

This fixed sbt parameter value causes bloopInstall fail in case of any of the dependencies sources download fails with error, for example if some of the sources URLs return HTTP ERROR 403. If I manually run just:

sbt bloopGenerate

my .bloop project json is generated successfully and I can use metals for the project. But...the sources of dependencies(even the downloaded ones) are not accessible from vscode/metals.

[tgodzik]

This parameter is needed to download source dependencies, which are used for go to definition in dependencies, so it's best to leave this parameter on. You can just run sbt bloopInstall instead, but that means it will not go to the dependencies.

What kind of dependencies are getting 403 status? I have very rarely seen any issue, so maybe it's a problem with you environment? Are you behind a proxy or using some additional repositories?

[ddurnev]

Sorry, the error is HTTP 401(unauthorized), not 403. This is a problem with source dependencies resolution: if some fail(for any reason) then the build import should not fail. But if fails since

sbt updateClassifiers

fails in this case.
For example, atlassian repo has some dependencies sources with http auth, try this:

https://packages.atlassian.com/maven-atlassian-external/jotm/jonas_timer/1.4.3/jonas_timer-1.4.3-sources.jar

[tgodzik]

With the most recent version we no longer fail if one module import has failed, but for specific dependencies we depend on sbt resolution. We might be able to handle it in the Bloop plugin (not 100% sure), but on the other hand if this needs authorization then downloading the normal jar will also fail, so we do need to fail in that case.

[ddurnev]

No, normal jar is downloaded OK (not requires auth) - try it yourself(use the link above without "-sources" in jar name), only source jars need auth. So jars are downloaded OK and
sbt bloopGenerate
succeeds if

-Dbloop.export-jar-classifiers=sources

is not set.
All accessible source jars could be also downloaded if not the failure with HTTP 401. For me the most important module import fails and no source jars are accessible in case of I run manual sbt bloopGenerate. Is there any workaround for this? BTW switching to sbt BSP not helps - fails with the same error on trying to DL source jars.

[tgodzik]

The only workaround is to run sbt bloopInstall command manually and not do Import build from metals.

This seems to be an error with the repository https://packages.atlassian.com/maven-atlassian-external/jotm/jonas_timer/1.4.3/ shows no source, so instead of 401, it should return 404, which I believe will be handled properly.

[ddurnev]

It returns 404 in case of any incorrect name (try q.jar), but for "-sources" qualifier it requests auth. So I believe it is really protected by auth for some reason :)

[tgodzik]

Hmm... it might be a security thing of them not wanting to share sources I guess. So the current workaround would be to import manually and you can raise an issue in the Bloop repository so that we can skip the 401 sources