Maven Assembly Plugin
  1. Maven Assembly Plugin
  2. MASSEMBLY-584

Assembly Plugin is looking for SNAPSHOT artifacts in release repositories

    Details

    • Type: Bug Bug
    • Status: Open Open
    • Priority: Blocker Blocker
    • Resolution: Unresolved
    • Affects Version/s: 2.2.1
    • Fix Version/s: None
    • Component/s: None
    • Labels:
      None
    • Environment:
      Windows 7, java 1.6.0_29, Maven 3.0.3
    • Number of attachments :
      0

      Description

      Assembly plugin fails to retrieve snapshot with unique version from repository, and as a result the generated zip file contains signatures-xades-1.2-SNAPSHOT.jar instead of signatures-xades-1.2-20111121.181823-3.jar.

      Descriptor:

      <assembly>
        <id>bin</id>
        <formats>
          <format>zip</format>
        </formats>
        <includeBaseDirectory>false</includeBaseDirectory>
        <dependencySets>
          <dependencySet>
            <outputDirectory>lib/</outputDirectory>
            <useProjectArtifact>false</useProjectArtifact>
          </dependencySet>
          <dependencySet>
            <outputDirectory>/</outputDirectory>
            <useProjectArtifact>true</useProjectArtifact>
            <includes>
                <include>${project.groupId}:${project.artifactId}</include>
            </includes>
          </dependencySet>
        </dependencySets>
      </assembly>
      

      Maven debug output (-X) contains:

      [DEBUG] Resolving project dependencies transitively.
      [DEBUG] lt.mitsoft.vmi:eds3-batch:war:1.0-SNAPSHOT (selected for null)
      [DEBUG] lt.mitsoft.vmi:eds3-mdoc:jar:1.0-SNAPSHOT:compile (selected for compile)
      [DEBUG] lt.mitsoft.adoc:adoc-core:jar:1.1:compile (selected for compile)
      ...
      [DEBUG] lt.mitsoft.pki.signatures:signatures-xades:jar:1.1:compile (selected for compile)
      ...
      [DEBUG] Verifying availability of C:\Users\Donatas\.m2\repository\lt\mitsoft\pki\signatures\signatures-xades\1.2-SNAPSHOT\signatures-xades-1.2-20111121.181823-3.pom from [central (https://int.mitsoft.lt:3681/artifactory/repo, releases), google (http://mbari-maven-repository.googlecode.com/svn/repository/, releases), org.tmatesoft.svnkit-releases (http://maven.tmatesoft.com/content/repositories/releases/, releases)]
      [WARNING] Missing POM for lt.mitsoft.pki.signatures:signatures-xades:jar:1.2-SNAPSHOT: Error resolving project artifact: Could not find artifact lt.mitsoft.pki.signatures:signatures-xades:pom:1.2-20111121.181823-3 for project lt.mitsoft.pki.signatures:signatures-xades:pom:1.2-SNAPSHOT
      [DEBUG] lt.mitsoft.pki.signatures:signatures-xades:jar:1.1:compile (removed - nearer found: 1.2-SNAPSHOT)
      [DEBUG] lt.mitsoft.pki.signatures:signatures-xades:jar:1.2-SNAPSHOT:compile (selected for compile)
      ...

      The problem is that artifact signatures-xades-1.2-20111121.181823-3.pom (that is, signatures-xades-1.2-SNAPSHOT) is being looked-up in release repositories (as shown above):

      [central (https://int.mitsoft.lt:3681/artifactory/repo, releases), 
      google (http://mbari-maven-repository.googlecode.com/svn/repository/, releases), 
      org.tmatesoft.svnkit-releases (http://maven.tmatesoft.com/content/repositories/releases/, releases)]
      

      The culprit might be the dependency override:

      [DEBUG]   lt.mitsoft.pki.signatures:signatures-xades:jar:1.1:compile (removed - nearer found: 1.2-SNAPSHOT)
      [DEBUG]   lt.mitsoft.pki.signatures:signatures-xades:jar:1.2-SNAPSHOT:compile (selected for compile)
      

      The first candidate was signatures-xades:jar:1.1 (release), but the chosen artifact is signatures-xades:jar:1.2-SNAPSHOT. I guess the repository type was chosen based on the first candidate, and this is wrong.

      Even bigger problem is that since POM retrieval failed, all dependencies specified in signatures-xades-1.2-20111121.181823-3.pom were not being taken into account (and are absent in generated zip file).

        Activity

        Hide
        Igor Postelnik added a comment - - edited

        I believe you can reproduce this by running maven with -U flag to force update of snapshot dependencies from a repo. This will cause assembly plugin to fail to include transitive dependencies because it fails to resolve the POM for dependent projects.

        I believe this only happens when you have both snapshot and release repos pointing at the same URL. We have Artifactory configured this way. DefaultDependencyResolver#aggregateRemoteArtifactRepositories appears to filter out repos with the same URL.

        Show
        Igor Postelnik added a comment - - edited I believe you can reproduce this by running maven with -U flag to force update of snapshot dependencies from a repo. This will cause assembly plugin to fail to include transitive dependencies because it fails to resolve the POM for dependent projects. I believe this only happens when you have both snapshot and release repos pointing at the same URL. We have Artifactory configured this way. DefaultDependencyResolver#aggregateRemoteArtifactRepositories appears to filter out repos with the same URL.
        Hide
        Donatas Ciuksys added a comment -

        I believe this only happens when you have both snapshot and release repos pointing at the same URL.

        Yes, this is a case - our snapshot and release repositories have the same URL. Yet this makes no problems for war and similar plugins.

        Show
        Donatas Ciuksys added a comment - I believe this only happens when you have both snapshot and release repos pointing at the same URL. Yes, this is a case - our snapshot and release repositories have the same URL. Yet this makes no problems for war and similar plugins.
        Hide
        Markus Mårtensson added a comment -

        Using version 2.4 of the plugin, I am missing transitive deps as a result of Missing POM for snapshots found in an Artifactory setup conveniently using the virtual /repo repository as a catchall for snapshots and release files regardless of source.

        Has there been any effort made in helping the plugin find snapshots stored in this manner?
        Any workarounds, other than changing the way the repository is setup?
        Any thoughts on making this a fatal error or at least explicitly warn about possible loss of transitive dependencies?

        Show
        Markus Mårtensson added a comment - Using version 2.4 of the plugin, I am missing transitive deps as a result of Missing POM for snapshots found in an Artifactory setup conveniently using the virtual /repo repository as a catchall for snapshots and release files regardless of source. Has there been any effort made in helping the plugin find snapshots stored in this manner? Any workarounds, other than changing the way the repository is setup? Any thoughts on making this a fatal error or at least explicitly warn about possible loss of transitive dependencies?
        Hide
        Jörg Sesterhenn added a comment -

        We still observe this behavior. Is this issue somewhere on your roadmap?

        Show
        Jörg Sesterhenn added a comment - We still observe this behavior. Is this issue somewhere on your roadmap?

          People

          • Assignee:
            Unassigned
            Reporter:
            Donatas Ciuksys
          • Votes:
            6 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

            • Created:
              Updated: