Maven 2 & 3

Artifact resolver incorrectly selects repository which doesn't contain the selected version

Details

  • Complexity:
    Intermediate
  • Testcase included:
    yes
  • Number of attachments :
    2

Description

The current logic for resolution of an artifact which has groupId/artifactId and then a range is for the DefaultArtifactCollector to call MavenMetadataSource and retrieve the available versions and then match the available versions to the range.

However, a side effect exists in that the DefaultRepositoryMetadataManager in its call to mergeMetadata sets the repository for the artifact. It currently just sets it to the last repository that had versions to merge. What occurs here though is that it can be set to a repository that doesn't actually have the artifact that is selected as part of the match of version range to available versions. Then when this artifact is passed to the resolver to download the JAR it references, it of course can't find it and an exception is thrown.

So there are a couple of issues here
1) Should the DefaultArtifactResolver really use artifact.getRepository() exclusively if it's not null? Perhaps the Artifact really ought to contain a list of repositories that are acceptable (from the transformation phase) from which to try. This may be a good enhancment.

but the more pressing issue is
2) Shouldn't the DefaultArtifactCollector actually do the repository selection, not have it be a side effect of getting the metadata.

The simple patch I've attached solves the problem by just removing the call to setRepository in the mergeMetadata method. This has the effect that there will be no repository chosen by the time the DefaultArtifactResolver gets a hold of the artifact and it will then go through the list of remoteRepositories until it finds a succesful match.

What I'd like to do though is really modify the DefaultArtifactCollector and MavenMetadataSource so that the collector can make the decision about what repository/list of repositories to use, and in the very least choose the repository that has the version that was matched in the range.

  1. File
    MNG-2098.simplefix.diff
    21/Feb/06 2:25 PM
    0.9 kB
    Garrett Conaty
  2. XML File
    pom.xml
    21/Feb/06 2:24 PM
    0.9 kB
    Garrett Conaty

Issue Links

is duplicated by

Bug - A problem which impairs or prevents the functions of the product. MNG-4380 Failure to resolve artifact if there is a dependency that uses version range

  • Major - Major loss of function.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.
relates to

Bug - A problem which impairs or prevents the functions of the product. MNG-2438 search for metadata in legacy repositories causes wrong repository source to be used for artifact resolution

  • Major - Major loss of function.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

Improvement - An improvement or enhancement to an existing feature or task. MNG-1974 Improve repository searching for artifacts

  • Minor - Minor loss of function, or other problem where easy workaround is present.
  • Open - The issue is open and ready for the assignee to start work on it.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Garrett Conaty added a comment -

This is the simple fix.

Show
Garrett Conaty added a comment - This is the simple fix.
Hide
Permalink
Brett Porter added a comment -

I believe the simple fix has more consequence than to just change the number of repos searched, but I'd need to investigate. This requires more careful consideration.

Show
Brett Porter added a comment - I believe the simple fix has more consequence than to just change the number of repos searched, but I'd need to investigate. This requires more careful consideration.
Hide
Permalink
Brett Porter added a comment -

from dev@:

Setting the repository is not exactly a side effect of resolving metadata, but I see why its a bug.
However, the collector can't select the repository as it doesn't know where it will be present.

The current logic is based on the use of snapshots - it considered that
releases would only be in one so the first found is used, whereas for
snapshots all must be checked and the newest used. I believe it works
for the latter.

It seems to be falling down only for version ranges, correct? I had
thought these should also operate as a transformation but that doesn't
sit with the whole resolution technique.

The actual version selection should be assigning a single repository to
it where the correct version was found.

This area of the code needs a lot more tests, in the order of what the
collector itself has. I suspect doing so will probably yield a lot of
clues for a better design also.

Show
Brett Porter added a comment - from dev@: Setting the repository is not exactly a side effect of resolving metadata, but I see why its a bug. However, the collector can't select the repository as it doesn't know where it will be present. The current logic is based on the use of snapshots - it considered that releases would only be in one so the first found is used, whereas for snapshots all must be checked and the newest used. I believe it works for the latter. It seems to be falling down only for version ranges, correct? I had thought these should also operate as a transformation but that doesn't sit with the whole resolution technique. The actual version selection should be assigning a single repository to it where the correct version was found. This area of the code needs a lot more tests, in the order of what the collector itself has. I suspect doing so will probably yield a lot of clues for a better design also.
Hide
Permalink
Casey Butterworth added a comment -

I can confirm that this is still happening in 2.0.6 and 2.0.7. However, the issue is more substantial than originally thought, i.e. not only happening for ranges but also for LATEST version transformation.

In our scenario, we are trying to resolve org.codehaus.mojo:jaxb2-maven-plugin and have not specified a version (i.e. LATEST). The following 2 repositories are specified for this project and both have the artifact available (central has the releases, codehaus.snapshot the snapshots).

central: http://repo1.maven.org/maven2/
codehaus.snapshot: http://snapshots.repository.codehaus.org/

In this scenario, DefaultRepositoryMetadataManager.mergeMetadata (line 167) is correctly updating the MetaData to include the versions from both the central and snapshot repositories. However, the repositories are processed in the order (1) central (2) codehaus.snapshot, and therefore the codehaus.snapshot repository is being set as the selected repository (line 169) as the last repo iterated over.

Afterwards, LatestArtifactTransformation.constructVersion() is retrieving the LATEST version (1.2) which is not available in the pre-selected repo (codehaus.snapshot), and the plugin's pom is not retrieved (resulting in a "Artifact not found - using stub model: Unable to locate resource in repository"). In this instance, this causes a ClassDefNotFound as the jaxb2 plugin's pom specifies dependencies.

We are able to work around the problem by (a) specifying a version for the plugin (1.2) or (b) specifying the dependencies in the plugin definition, however, it took a while to get to this stage.

I am reasonably sure that the fix suggested by Garrett would fix the problem.

Let me know if this is not clear enough.

Cheers
Casey

Show
Casey Butterworth added a comment - I can confirm that this is still happening in 2.0.6 and 2.0.7. However, the issue is more substantial than originally thought, i.e. not only happening for ranges but also for LATEST version transformation. In our scenario, we are trying to resolve org.codehaus.mojo:jaxb2-maven-plugin and have not specified a version (i.e. LATEST). The following 2 repositories are specified for this project and both have the artifact available (central has the releases, codehaus.snapshot the snapshots). central: http://repo1.maven.org/maven2/ codehaus.snapshot: http://snapshots.repository.codehaus.org/ In this scenario, DefaultRepositoryMetadataManager.mergeMetadata (line 167) is correctly updating the MetaData to include the versions from both the central and snapshot repositories. However, the repositories are processed in the order (1) central (2) codehaus.snapshot, and therefore the codehaus.snapshot repository is being set as the selected repository (line 169) as the last repo iterated over. Afterwards, LatestArtifactTransformation.constructVersion() is retrieving the LATEST version (1.2) which is not available in the pre-selected repo (codehaus.snapshot), and the plugin's pom is not retrieved (resulting in a "Artifact not found - using stub model: Unable to locate resource in repository"). In this instance, this causes a ClassDefNotFound as the jaxb2 plugin's pom specifies dependencies. We are able to work around the problem by (a) specifying a version for the plugin (1.2) or (b) specifying the dependencies in the plugin definition, however, it took a while to get to this stage. I am reasonably sure that the fix suggested by Garrett would fix the problem. Let me know if this is not clear enough. Cheers Casey
Hide
Permalink
Benjamin Bentmann added a comment -

Fixed in r818829.

Show
Benjamin Bentmann added a comment - Fixed in r818829 .

People

  • Assignee:
    Benjamin Bentmann
    Reporter:
    Garrett Conaty
Vote (9)
Watch (9)

Dates

  • Created:
    Updated:
    Resolved: