Glowstone install: Maven peer not authenticated / could not resolve dependencies error - maven

Question

I was closely following the ‘Building’ instructions from the readme for Glowstone https://github.com/GlowstoneMC/Glowstone
but whenever I try ./setup.sh, it fails building with this stack trace:
Failed to execute goal on project glowstone: Could not resolve dependencies for project net.glowstone:glowstone:jar:1.10.2-SNAPSHOT: Failed to collect dependencies for [net.glowstone:glowkit:jar:1.10.2-R0.1-SNAPSHOT (compile), com.flowpowered:flow-network:jar:1.1.0-SNAPSHOT (compile), jline:jline:jar:2.11 (compile), org.projectlombok:lombok:jar:1.14.8 (provided), net.sf.trove4j:trove4j:jar:3.0.3 (compile), co.aikar:fastutil-lite:jar:1.0 (compile), org.jetbrains.kotlin:kotlin-runtime:jar:1.1-SNAPSHOT (compile), org.jetbrains.kotlin:kotlin-reflect:jar:1.1-SNAPSHOT (compile), io.netty:netty-transport-native-epoll:jar:4.1.0.CR7 (compile), junit:junit:jar:4.12 (test)]: Failed to read artifact descriptor for net.glowstone:glowkit:jar:1.10.2-R0.1-SNAPSHOT: Could not transfer artifact net.glowstone:glowkit:pom:1.10.2-R0.1-SNAPSHOT from/to glowstone-snapshots (https://repo.glowstone.net/content/repositories/snapshots/): peer not authenticated -> [Help 1]
I tried looking at the maven website for some hints on DependencyResolutionException and peer not authenticated error, but it didn't help. Anyone please help me, I've been stuck for a couple weeks with no progress.

Answer 1

I tried the same instructions and was able to reproduce your error exactly.
The problem seems to be with maven not being able to communicate securely with the repositories specified in the pom; see this answer.
After some fiddling, I was able to get the build.sh script (which is just running mvn package) to run successfully. The main idea is to lock down the dependency versions in the pom to non-SNAPSHOT versions, so that none of them need to be retrieved from those problematic repositories.
These steps should get you to a working build:
In the pom, change the kotlin-runtime and kotlin-reflect dependency versions from 1.1-SNAPSHOT
to 1.0.4.
Change the flow-network dependency version from 1.1.0-SNAPSHOT
to 1.0.0.
Download glowkit-1.10.2-R0.1-20160907.003121-11.jar and glowkit-1.10.2-R0.1-20160907.003121-11.pom and put them in the right place in your local repo (for me, that was ~/.m2/repository/net/glowstone/glowkit/1.10.2-R0.1-SNAPSHOT/)
Now you can change the value of the bukkit.version property in the pom from 1.10.2-R0.1-SNAPSHOT to 1.10.2-R0.1-20160907.003121-11
Similarly, download fastutil-lite-1.0.jar and fastutil-lite-1.0.pom from http://ci.emc.gs/nexus/content/repositories/aikar/co/aikar/fastutil-lite/1.0/, and place them in your local mvn repo (~/.m2/repository/co/aikar/fastutil-lite/1.0/)
NOTE that doing this much should have resolved all of the problems with downloading the dependencies, so at least something like mvn dependency:tree should run successfully.
Finally, even after resolving those dependency issues, there is a compilation problem because of the version of netty being used. Change the dependency version for netty-transport-native-epoll from 4.1.0.CR7 to 4.1.5.Final. Also you will have to add this explicit dependency on netty-all, since otherwise, flow-network will pull in an earlier version:
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-all</artifactId>
<version>4.1.5.Final</version>
</dependency>
That should do it! After those steps, the mvn package, and so the setup.sh script, ran successfully for me.

Answer 2

This error is caused by an incompatibility in the SSL stack connecting to repo.glowstone.net.
Downgrading dependencies to avoid connecting to the Glowstone repository may avoid this particular problem, but creates other problems, and does not currently work on the latest Glowstone build since it requires the snapshot dependencies (see GH-467 on GitHub GlowstoneMC issue tracker) and also from discussion with Glowstone developers, and my own testing, downgrading now causes a different error: java.lang.IllegalAccessError: class lombok.javac.apt.Processor (in unnamed module #0x18c23b6))
Maven's error message peer not authenticated doesn't explicitly say so, but it is caused by repo.glowstone.net requiring the Server Name Indication (SNI) extension (needed by Cloudflare Flexible SSL), which older versions of Maven do not support. You can verify this by performing an SSLLabs scan on this server, which reports "This site works only in browsers with SNI support.", and capturing the SSL handshake in Wireshark which shows the server drops the connection after the first Client Hello, without server_name:
Wireshark capture demonstrating missing Extension: server_name
Wireshark capture demonstrating server closing connection
The fix is simple: upgrade to a version of Maven supporting SNI. In my case I had Maven 3.0.5 but updating to Maven 3.5.0 from maven.apache.org fixed the problem and I was able to build Glowstone without a hitch.
You can check the version of Maven you have with mvn -version, it should show something like this (the critical versions for Glowstone are Apache Maven 3.5.0+ and Java version: 1.8.0_131):
Glowstone $ mvn -version
Apache Maven 3.5.0 (ff8f5e7444045639af65f6095c62210b5713f426; 2017-04-03T12:39:06-07:00)
Maven home: /Users/admin/.m2
Java version: 1.8.0_131, vendor: Oracle Corporation
Java home: /Library/Java/JavaVirtualMachines/jdk1.8.0_131.jdk/Contents/Home/jre
Default locale: en_US, platform encoding: UTF-8