Dependencies should not be able to introduce repositories to the build

Details

Description

If you depend on an artifact that has repositories or pluginRepositories defined in the pom, those repositories are also searched for artifacts.

It's disconcerting when you think you've overridden 'central' and set things up to use only internal repositories, and Maven still tries to to download artifacts from elsewhere.

Issue Links

is related to

Bug - A problem which impairs or prevents the functions of the product. MNG-3384 Repos defined in plugin are used to download dependencies

  • Major - Major loss of function.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

New Feature - A new feature of the product, which has yet to be developed. MNG-4420 It should be possible to define your mirrors section inside a profile

  • Minor - Minor loss of function, or other problem where easy workaround is present.
  • Open - The issue is open and ready for the assignee to start work on it.
relates to

Bug - A problem which impairs or prevents the functions of the product. MNG-3052 Transitive Dependency not found when repo is not listed

  • Critical - Crashes, loss of data, severe memory leak.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

Bug - A problem which impairs or prevents the functions of the product. MNG-4353 [regression] Plugin dependencies are not downloaded from repos given in the plugin's POM

  • Major - Major loss of function.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

Bug - A problem which impairs or prevents the functions of the product. MNG-4413 [regression] Repositories discovered in dependency POMs are not subject to mirroring

  • Major - Major loss of function.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

New Feature - A new feature of the product, which has yet to be developed. MNG-4710 Command line option to use dependency repositories

  • Major - Major loss of function.
  • Open - The issue is open and ready for the assignee to start work on it.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Jason van Zyl added a comment -

This can't change for 2.0.x but it does make resolution unpredictable. Repositories need to be all gathered prior to resolution. The repositories should be removed from the model in 2.1.

Show
Jason van Zyl added a comment - This can't change for 2.0.x but it does make resolution unpredictable. Repositories need to be all gathered prior to resolution. The repositories should be removed from the model in 2.1.
Hide
Permalink
Wendy Smoak added a comment -

I'm not sure I'd go as far as disallowing repositories in the pom altogether. We would lose the ability to define snapshot repositories so that you can check out and build a project without changing your settings. I just don't want repository definitions to be "transitive".

Show
Wendy Smoak added a comment - I'm not sure I'd go as far as disallowing repositories in the pom altogether. We would lose the ability to define snapshot repositories so that you can check out and build a project without changing your settings. I just don't want repository definitions to be "transitive".
Hide
Permalink
Mark Hobson added a comment -

Is this not the opposite of MNG-3052?

Show
Mark Hobson added a comment - Is this not the opposite of MNG-3052?
Hide
Permalink
Paul Gier added a comment -

I agree with Wendy that repositories should not be transitive. It makes things difficult when trying to limit which repositories you are downloading from. This does look like the opposite of MNG-3052. Maybe there should be a command line or settings.xml option to determine whether transitive repositories are allowed or not.

Show
Paul Gier added a comment - I agree with Wendy that repositories should not be transitive. It makes things difficult when trying to limit which repositories you are downloading from. This does look like the opposite of MNG-3052. Maybe there should be a command line or settings.xml option to determine whether transitive repositories are allowed or not.

People

  • Assignee:
    Jason van Zyl
    Reporter:
    Wendy Smoak
Vote (3)
Watch (7)

Dates

  • Created:
    Updated: