Hi @twwwt,
Sorry for not seeing this earlier. In the future, please don’t hesitate to reach out to security@gradle.com about issues like this in the future.
To respond to your question, that redirect to cloudfront is due to a redirect response from JCenter, not from us. The Gradle Plugin Portal mirrors JCenter to resolve artifacts that aren’t plugins.
You can see that here:
wget https://plugins.gradle.org/m2/org/apache/httpcomponents/httpcore/4.2.1/httpcore-4.2.1.jar 2>&1 | grep Location:
Location: https://jcenter.bintray.com/org/apache/httpcomponents/httpcore/4.2.1/httpcore-4.2.1.jar [following]
Location: https://d29vzk4ow07wi7.cloudfront.net/2d503272bf0a8b5f92d64db78b4ba9abbaccc6fd?response-content-disposition=attachment%3Bfilename%3D%22httpcore-4.2.1.jar%22&Policy=eyJTdGF0ZW1lbnQiOiBbeyJSZXNvdXJjZSI6Imh0dHAqOi8vZDI5dnprNG93MDd3aTcuY2xvdWRmcm9udC5uZXQvMmQ1MDMyNzJiZjBhOGI1ZjkyZDY0ZGI3OGI0YmE5YWJiYWNjYzZmZD9yZXNwb25zZS1jb250ZW50LWRpc3Bvc2l0aW9uPWF0dGFjaG1lbnQlM0JmaWxlbmFtZSUzRCUyMmh0dHBjb3JlLTQuMi4xLmphciUyMiIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTU3NjY4Mzk5NX0sIklwQWRkcmVzcyI6eyJBV1M6U291cmNlSXAiOiIwLjAuMC4wLzAifX19XX0_&Signature=kdxjhN1LcYW1piY-7uttENQqqsjo83q8q1npFeYbxagaqLmxwARuBJkdYgPZm~K7-Fujdyau0b6mi~ECL9wHGWl5lYJkTgLn-7ua00OQe32Sr9~hZLDPuUyRnTaUVeYJHRePfwWT-j0Xm4n69uxSmdUa933iJgy12BKbAx7j6HtzHTFnMquzeSKTjGEpnNPOzDez0puCOPzQA5xvHQrAb7jiS2o1R5hxYRvKzHMnkUCnlXb5zKyo90bzepzTaLu5dv14-~PUXjbf9ybazzIOluJ6LuPOcWS253QD~TRNHasIXUiwSB5lLrHnDzqLTUgBOW2leUW9BoLQFiCbQMe4Cg__&Key-Pair-Id=APKAIFKFWOMXM2UMTSFA [following]
I’ll reach out to JCenter’s Security Team about this issue and get back to you.