Remove repo.scala-sbt.org and repo.typesafe.com from boot resolver

[eed3si9n]

This was originally proposed by @mkurz as #7174 (comment).

IMHO for 2.0 it should be considered to drop the deprecated repo.scala-sbt.org and repo.typesafe.com repos.
Within the last weeks I helped migrating more or less all missing sbt plugins/projects to maven central. I can now build and test Play, Pekko, Akka and even sbt itself with having repo.scala-sbt.org and repo.typesafe.com blocked in my /etc/hosts (and of course having any local artifacts of those repos deleted in my local coursier and even ivy cache).
People can still add the repos themselves if needed, but I doubt when using sbt 2 you will need that repos anymore.
I think we should make clear that you should not use that repos anymore. I think it's better to cut off those repositories sooner rather than later.

notes on sbt 0.13 support

Given that sbt 0.13 artifacts are hosted on repo.scala-sbt.org, we should create a new directive bootOnlyZero in addition to current bootOnly directive:

   sbt-maven-releases: https://repo.scala-sbt.org/scalasbt/maven-releases/, bootOnly 
   sbt-maven-snapshots: https://repo.scala-sbt.org/scalasbt/maven-snapshots/, bootOnly 
   typesafe-ivy-releases: https://repo.typesafe.com/typesafe/ivy-releases/, [organization]/[module]/[revision]/[type]s/[artifact](-[classifier]).[ext], bootOnly 
   sbt-ivy-snapshots: https://repo.scala-sbt.org/scalasbt/ivy-snapshots/, [organization]/[module]/[revision]/[type]s/[artifact](-[classifier]).[ext], bootOnly 

If possible, this would allow the user to resolve sbt 0.13 automatically while using the new launcher.

[SethTisue]

Besides the other reasons to do this, there's performance: querying those resolvers takes time.

I think this change would be fair game for sbt 1.10.

[mkurz]

On top of that, I also suggest to print warnings whenever these methods are being called:

  private[sbt] def typesafeRepositoryRoot(secure: Boolean) =
    (if (secure) "https" else "http") + "://repo.typesafe.com/typesafe"
  // TODO: This switch is only kept for backward compatibility. Hardcode to HTTPS in the future.
  private[sbt] def sbtRepositoryRoot(secure: Boolean) =
    (if (secure) "https" else "http") + "://repo.scala-sbt.org/scalasbt"

And/or deprecate following methods:

• https://github.com/sbt/librarymanagement/blob/54011d5e74335bab229bc3f6532b6a1ca6d0d5cd/core/src/main/scala/sbt/librarymanagement/ResolverExtra.scala#L153-L158
• https://github.com/sbt/librarymanagement/blob/54011d5e74335bab229bc3f6532b6a1ca6d0d5cd/core/src/main/scala/sbt/librarymanagement/ResolverExtra.scala#L147-L152

btw, I totally cut off Play from those repos now:

• Block deprecated repos in /etc/hosts playframework/.github#76 (this PR blocks the repos in our globally used reusable workflows)

[eed3si9n]

I have this sort of working on my laptop (see also sbt/launcher#103), and I'm not 100% sure if this would be a good thing or a bad thing overall.

The user would get something like this:

$ java -jar $HOME/work/sbt-modules/sbt/launch/target/sbt-launch.jar
[info] welcome to sbt 1.10.0-SNAPSHOT (Azul Systems, Inc. Java 1.8.0_352)
[info] loading settings for project global-plugins from idea.sbt,pgp.sbt,plugins.sbt,vimquit.sbt ...
[info] loading global plugins from /Users/xxx/.sbt/1.0/plugins
[info] loading settings for project foo-build from plugins.sbt ...
[info] loading project definition from /private/tmp/foo/project
[info] Updating
[info] Resolved  dependencies
[warn]
[warn] 	Note: Some unresolved dependencies have extra attributes.  Check that these dependencies exist with the requested attributes.
[warn] 		com.eed3si9n:sbt-assembly:0.15.0 (sbtVersion=1.0, scalaVersion=2.12)
[warn] 		com.eed3si9n:sbt-vimquit:0.1.0 (scalaVersion=2.12, sbtVersion=1.0)
[warn]
[warn] 	Note: Unresolved dependencies path:
[error] sbt.librarymanagement.ResolveException: Error downloading com.eed3si9n:sbt-assembly;sbtVersion=1.0;scalaVersion=2.12:0.15.0
[error]   Not found
[error]   Not found
[error]   not found: /Users/xxx/.ivy2/local/com.eed3si9n/sbt-assembly/scala_2.12/sbt_1.0/0.15.0/ivys/ivy.xml
[error]   not found: https://repo1.maven.org/maven2/com/eed3si9n/sbt-assembly_2.12_1.0/0.15.0/sbt-assembly-0.15.0.pom
[error] Error downloading com.eed3si9n:sbt-vimquit;sbtVersion=1.0;scalaVersion=2.12:0.1.0
[error]   Not found
[error]   Not found
[error]   not found: /Users/xxx/.ivy2/local/com.eed3si9n/sbt-vimquit/scala_2.12/sbt_1.0/0.1.0/ivys/ivy.xml
[error]   not found: https://repo1.maven.org/maven2/com/eed3si9n/sbt-vimquit_2.12_1.0/0.1.0/sbt-vimquit-0.1.0.pom
[error] 	at lmcoursier.CoursierDependencyResolution.unresolvedWarningOrThrow(CoursierDependencyResolution.scala:344)
[error] 	at lmcoursier.CoursierDependencyResolution.$anonfun$update$38(CoursierDependencyResolution.scala:313)
[error] 	at scala.util.Either$LeftProjection.map(Either.scala:573)
[error] 	at lmcoursier.CoursierDependencyResolution.update(CoursierDependencyResolution.scala:313)
[error] 	at sbt.librarymanagement.DependencyResolution.update(DependencyResolution.scala:60)
[error] 	at sbt.internal.LibraryManagement$.resolve$1(LibraryManagement.scala:60)
[error] 	at sbt.internal.LibraryManagement$.$anonfun$cachedUpdate$12(LibraryManagement.scala:134)
[error] 	at sbt.util.Tracked$.$anonfun$lastOutput$1(Tracked.scala:74)
[error] 	at sbt.internal.LibraryManagement$.$anonfun$cachedUpdate$20(LibraryManagement.scala:147)
[error] 	at scala.util.control.Exception$Catch.apply(Exception.scala:228)
[error] 	at sbt.internal.LibraryManagement$.$anonfun$cachedUpdate$11(LibraryManagement.scala:147)
[error] 	at sbt.internal.LibraryManagement$.$anonfun$cachedUpdate$11$adapted(LibraryManagement.scala:128)
[error] 	at sbt.util.Tracked$.$anonfun$inputChangedW$1(Tracked.scala:220)
[error] 	at sbt.internal.LibraryManagement$.cachedUpdate(LibraryManagement.scala:161)
[error] 	at sbt.Classpaths$.$anonfun$updateTask0$1(Defaults.scala:3800)
[error] 	at scala.Function1.$anonfun$compose$1(Function1.scala:49)
[error] 	at sbt.internal.util.$tilde$greater.$anonfun$$u2219$1(TypeFunctions.scala:63)
[error] 	at sbt.std.Transform$$anon$4.work(Transform.scala:69)
[error] 	at sbt.Execute.$anonfun$submit$2(Execute.scala:283)
[error] 	at sbt.internal.util.ErrorHandling$.wideConvert(ErrorHandling.scala:24)
[error] 	at sbt.Execute.work(Execute.scala:292)
[error] 	at sbt.Execute.$anonfun$submit$1(Execute.scala:283)
[error] 	at sbt.ConcurrentRestrictions$$anon$4.$anonfun$submitValid$1(ConcurrentRestrictions.scala:265)
[error] 	at sbt.CompletionService$$anon$2.call(CompletionService.scala:65)
[error] 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
[error] 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
[error] 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
[error] 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
[error] 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
[error] 	at java.lang.Thread.run(Thread.java:750)
[error] (update) sbt.librarymanagement.ResolveException: Error downloading com.eed3si9n:sbt-assembly;sbtVersion=1.0;scalaVersion=2.12:0.15.0

Note here that sbt-vimquit is a global (machine-wide) plugin that I have configured. This can also be some older plugins for IDE etc. The fix would be to add resolvers, but I am starting to worry this could be something a new user can easily hit and won't be able to fix on their own, even if we printed better error messages.

[SethTisue]

How about if only a single command-line flag was enough to add the extra resolvers?