[Updated] (MNG-6283) [regression] resolution of nested import-scoped transitive dependencies ignores repositories overwriting 'central'

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

[Updated] (MNG-6283) [regression] resolution of nested import-scoped transitive dependencies ignores repositories overwriting 'central'

JIRA jira@apache.org

     [ https://issues.apache.org/jira/browse/MNG-6283?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Stefan Dellmuth updated MNG-6283:
---------------------------------
    Description:
We have one occurrence of a "nested BOM", i.e. an import-scoped dependency which is transitively resolved as part of another import-scoped dependency. Moreover, as we are behind a company proxy, our only way of downloading dependencies is via a repository in our Maven settings called {{central}} and thus overwriting the default Maven Central repository.

Maven 3.2.2 introduced a regression which breaks the resolution of such nested BOM dependencies. Maven tries to resolve them against the Maven Central repository instead of our own.

So:
{code:xml}
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>de.msg.maven</groupId>
    <artifactId>nested-import-scope-example</artifactId>
    <version>1.0</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>de.msg.maven</groupId>
                <artifactId>nested-import-scope-bom</artifactId>
                <version>1.0</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
</project>
{code}

...which in turn leads to...

{code:xml}
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>de.msg.maven</groupId>
    <artifactId>nested-import-scope-bom</artifactId>
    <version>1.0</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.jboss.bom.wfk</groupId>
                <artifactId>jboss-javaee-6.0-with-tools</artifactId>
                <version>2.4.0-redhat-2</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

</project>
{code}

Maven settings contain:
{code:xml}
<profiles>
    <profile>
    <repositories>
            <repository>
            <id>central</id>
            <url>http://maven.repository.redhat.com/techpreview/all/</url>
            </repository>
    </repositories>
        <id>jboss</id>
    </profile>
</profiles>
<activeProfiles>
    <activeProfile>jboss</activeProfile>
</activeProfiles>
{code}

In this case, if I want to resolve the dependencies of {{nested-import-scope-example}} (while having {{nested-import-scope-bom}} available in my local or company's repository) fails because Maven tries to download the JBoss BOM from Maven Central.

Workaround: Renaming our company repository's ID to something other than {{central}} works as expected.

Disclaimer:
As I can't use our company repository's address here, I've reproduced the problem with the example of MNG-5663 which I've found during my research.

  was:
We have one occurrence a "nested BOM", i.e. an import-scoped dependency which is transitively resolved as part of another import-scoped dependency. Moreover, as we are behind a company proxy, our only way of downloading dependencies is via a repository in our Maven settings called {{central}} and thus overwriting the default Maven Central repository.

Maven 3.2.2 introduced a regression which breaks the resolution of such nested BOM dependencies. Maven tries to resolve them against the Maven Central repository instead of our own.

So:
{code:xml}
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>de.msg.maven</groupId>
    <artifactId>nested-import-scope-example</artifactId>
    <version>1.0</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>de.msg.maven</groupId>
                <artifactId>nested-import-scope-bom</artifactId>
                <version>1.0</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
</project>
{code}

...which in turn leads to...

{code:xml}
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>de.msg.maven</groupId>
    <artifactId>nested-import-scope-bom</artifactId>
    <version>1.0</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.jboss.bom.wfk</groupId>
                <artifactId>jboss-javaee-6.0-with-tools</artifactId>
                <version>2.4.0-redhat-2</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

</project>
{code}

Maven settings contain:
{code:xml}
<profiles>
    <profile>
    <repositories>
            <repository>
            <id>central</id>
            <url>http://maven.repository.redhat.com/techpreview/all/</url>
            </repository>
    </repositories>
        <id>jboss</id>
    </profile>
</profiles>
<activeProfiles>
    <activeProfile>jboss</activeProfile>
</activeProfiles>
{code}

In this case, if I want to resolve the dependencies of {{nested-import-scope-example}} (while having {{nested-import-scope-bom}} available in my local or company's repository) fails because Maven tries to download the JBoss BOM from Maven Central.

Workaround: Renaming our company repository's ID to something other than {{central}} works as expected.

Disclaimer:
As I can't use our company repository's address here, I've reproduced the problem with the example of MNG-5663 which I've found during my research.


> [regression] resolution of nested import-scoped transitive dependencies ignores repositories overwriting 'central'
> ------------------------------------------------------------------------------------------------------------------
>
>                 Key: MNG-6283
>                 URL: https://issues.apache.org/jira/browse/MNG-6283
>             Project: Maven
>          Issue Type: Bug
>          Components: Artifacts and Repositories, Dependencies
>    Affects Versions: 3.2.2, 3.5.0
>            Reporter: Stefan Dellmuth
>
> We have one occurrence of a "nested BOM", i.e. an import-scoped dependency which is transitively resolved as part of another import-scoped dependency. Moreover, as we are behind a company proxy, our only way of downloading dependencies is via a repository in our Maven settings called {{central}} and thus overwriting the default Maven Central repository.
> Maven 3.2.2 introduced a regression which breaks the resolution of such nested BOM dependencies. Maven tries to resolve them against the Maven Central repository instead of our own.
> So:
> {code:xml}
> <project xmlns="http://maven.apache.org/POM/4.0.0"
>          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
>     <modelVersion>4.0.0</modelVersion>
>     <groupId>de.msg.maven</groupId>
>     <artifactId>nested-import-scope-example</artifactId>
>     <version>1.0</version>
>     <packaging>pom</packaging>
>     <dependencyManagement>
>         <dependencies>
>             <dependency>
>                 <groupId>de.msg.maven</groupId>
>                 <artifactId>nested-import-scope-bom</artifactId>
>                 <version>1.0</version>
>                 <type>pom</type>
>                 <scope>import</scope>
>             </dependency>
>         </dependencies>
>     </dependencyManagement>
> </project>
> {code}
> ...which in turn leads to...
> {code:xml}
> <project xmlns="http://maven.apache.org/POM/4.0.0"
>          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
>     <modelVersion>4.0.0</modelVersion>
>     <groupId>de.msg.maven</groupId>
>     <artifactId>nested-import-scope-bom</artifactId>
>     <version>1.0</version>
>     <packaging>pom</packaging>
>     <dependencyManagement>
>         <dependencies>
>             <dependency>
>                 <groupId>org.jboss.bom.wfk</groupId>
>                 <artifactId>jboss-javaee-6.0-with-tools</artifactId>
>                 <version>2.4.0-redhat-2</version>
>                 <type>pom</type>
>                 <scope>import</scope>
>             </dependency>
>         </dependencies>
>     </dependencyManagement>
> </project>
> {code}
> Maven settings contain:
> {code:xml}
> <profiles>
>     <profile>
>     <repositories>
>             <repository>
>             <id>central</id>
>             <url>http://maven.repository.redhat.com/techpreview/all/</url>
>             </repository>
>     </repositories>
> <id>jboss</id>
>     </profile>
> </profiles>
> <activeProfiles>
>     <activeProfile>jboss</activeProfile>
> </activeProfiles>
> {code}
> In this case, if I want to resolve the dependencies of {{nested-import-scope-example}} (while having {{nested-import-scope-bom}} available in my local or company's repository) fails because Maven tries to download the JBoss BOM from Maven Central.
> Workaround: Renaming our company repository's ID to something other than {{central}} works as expected.
> Disclaimer:
> As I can't use our company repository's address here, I've reproduced the problem with the example of MNG-5663 which I've found during my research.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)