Build logs "Downloading from shibboleth-repo: .."

[Sanne]

Describe the bug

When building a Quarkus application using the MSSQL JDBC driver, this dependency is pulling in an additional dependency com.nimbusds:oauth2-oidc-sdk whose pom.xml defines an additional Maven repository <id>shibboleth-repo</id>.

This additional repository gets activated, as evidenced by the log:

Downloading from shibboleth-repo: https://build.shibboleth.net/nexus/content/repositories/releases/net/minidev/json-smart/maven-metadata.xml

Fetched metadata also actually pollute the local build repository; I'm considering this a problem as we don't want additional repositories being activated behind user's back:

• they might not trust it (although this one looks sane)
• it slows down other aspects of the build
• it makes it harder to configure proxies and mirrors for firewalled builds

In general it's a bad practice to have such repositories in a pom as it leads to supply chain concerns.