[MNG-5781] resolution of nested import scoped dependencies causes maven to reach out to external central repo

[jira-importer]

Ravi Sanwal opened MNG-5781 and commented

When a project uses a dependency that has as import scoped dependency, which in turn also has another import scoped dependency (nested imported scoped dependencies), resolution of the last level of dependency makes maven to reach our to the external central repository (https://repo.maven.apache.org/maven2/)

Steps to reproduce:
Use the attached global settings file.
It has an internal repository declared as a replacement to 'central', you can point to one of your own internal repo.(not the local)

Build the attached file first.pom.xml: 

mvn -gs global_settings.xml install -f first.pom.xml

Build the attached file second.pom.xml:

mvn install -f second.pom.xml

Then, delete org.aspectj:aspectjtools from local repo (rm ~/.m2/repository/org/aspectj/aspectjtools), we want to download this from our internal central repository alias repository.
Build the attached file last.pom.xml: 

mvn -gs global_settings.xml dependency:copy-dependencies -f last.pom.xml

(copy dependencies because this is a pom project, alternatively change last.pom.xml to a jar project and do mvn -gs global_settings.xml install - same thing)

You'll see that org.aspectj:aspectjtools is being downloaded from central (https://repo.maven.apache.org/maven2/) effectively rendering hosting our own repositories useless.

---

Affects: 3.2.5

Attachments:

• first.pom.xml (754 bytes)
• global_settings.xml (1004 bytes)
• last.pom.xml (904 bytes)
• MNG-5781-Maven360.txt (26.88 kB)
• second.pom.xml (685 bytes)

Issue Links:

• MNG-6772 Super POM overwrites remapped central repository in nested dependencyManagement import POMs
  ("is duplicated by")

1 votes, 9 watchers

[jira-importer]

Ravi Sanwal commented

The files.

[jira-importer]

Ravi Sanwal commented

Please change the repository URLs in global_settings.xml as per your needs.

[jira-importer]

Jochen Ehret commented

Hi,

we have observed a similar problem with Maven 3.2.3 and 3.3.3 (3.2.2 works!). We have:

"jar" project -> "jar" project -> "pom" project -> "pom" project
              ^                ^                ^
              |                |                |
   (compile) dependency   parent pom   import-scoped dependency

Maven tries to resolve the last project from the Maven central repo, although we've specified an internal repo in our settings.xml. We suspect that this has been caused by the changes of [MNG-5663]. Can you please investigate?

Thanks and Best Regards,

Jochen.

[jira-importer]

Sylwester Lachiewicz commented

Still valid issue with - logs [^MNG-5781-Maven360.txt]

[jira-importer]

Michael Osipov commented

This is basically a duplicate of MNG-6772 depicting the same problem.

[jira-importer]

Ravi Sanwal commented

Thanks Michael. I hope you meant the other way around. The other ticket being duplicate of this.

[jira-importer]

Michael Osipov commented

Either way, can you confirm that both issues are describing the same problem?

[jira-importer]

Hervé Boutemy commented

looking at it, yes, it seems MNG-6772 is a duplicate of this issue

but this issue is more clear and seems to have a good simple test: I'll probably use it to dig more

[jira-importer]

Hervé Boutemy commented

Ravi Sanwal I just had a look at your sample
it seems that in your case, it's settings content that does not get the intended effect, isn't it? then more like MNG-4645
MNG-6772 is more about if repository was defined in last.pom.xml

do you confirm?

notice that while working on 1 I will probably work on the other, because there is a link which is deep dive into dependency resolution

[jira-importer]

Hervé Boutemy commented

at least, I can reuse Jochen description, because it's IMHO a good way to describe the type of issues we're facing