[jira] Created: (MNG-3678) Maven downloads from snapshot repos even when no snapshot repository is in the pom

Maven downloads from snapshot repos even when no snapshot repository is in the pom
----------------------------------------------------------------------------------

                 Key: MNG-3678
                 URL: http://jira.codehaus.org/browse/MNG-3678
             Project: Maven 2
          Issue Type: Bug
    Affects Versions: 2.0.9
         Environment: Win XP
            Reporter: Julien HENRY
         Attachments: pom.xml, stack.txt

Easy to reproduce. Start with an empty local repository (rename ~/.m2/repository) and use a very simple pom.xml. The tips is to use a pom project instead of a jar project. Now run mvn clean install.

In the log, you will see:
...
Downloading: http://snapshots.repository.codehaus.org/org/mortbay/jetty/servlet-api-2.5/6.1.5/servlet-api-2.5-6.1.5.jar
Downloading: http://people.apache.org/repo/m2-snapshot-repository//org/mortbay/jetty/servlet-api-2.5/6.1.5/servlet-api-2.5-6.1.5.jar
...

I think there are some <repository> sections in some pom.xml on Ibiblio that still contain snapshot repositories.

--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.codehaus.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

    [ http://jira.codehaus.org/browse/MNG-3678?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=143041#action_143041 ]

Vincent Siveton commented on MNG-3678:
--------------------------------------

Some default plugins defined in the super pom [1] specify some repositories (like maven-assembly-plugin:2.2-beta-2) or use dependencies which have repositories section in their pom (like maven-ear-plugin:2.3.1 with maven-project:2.0.4->maven-project:2.0.4)

[1] https://svn.apache.org/repos/asf/maven/components/branches/maven-2.0.x/maven-project/src/main/resources/org/apache/maven/project/pom-4.0.0.xml

> Maven downloads from snapshot repos even when no snapshot repository is in the pom
> ----------------------------------------------------------------------------------
>
>                 Key: MNG-3678
>                 URL: http://jira.codehaus.org/browse/MNG-3678
>             Project: Maven 2
>          Issue Type: Bug
>    Affects Versions: 2.0.9
>         Environment: Win XP
>            Reporter: Julien HENRY
>         Attachments: pom.xml, stack.txt
>
>
> Easy to reproduce. Start with an empty local repository (rename ~/.m2/repository) and use a very simple pom.xml. The tips is to use a pom project instead of a jar project. Now run mvn clean install.
> In the log, you will see:
> ...
> Downloading: http://snapshots.repository.codehaus.org/org/mortbay/jetty/servlet-api-2.5/6.1.5/servlet-api-2.5-6.1.5.jar
> Downloading: http://people.apache.org/repo/m2-snapshot-repository//org/mortbay/jetty/servlet-api-2.5/6.1.5/servlet-api-2.5-6.1.5.jar
> ...
> I think there are some <repository> sections in some pom.xml on Ibiblio that still contain snapshot repositories.

--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.codehaus.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

     [ http://jira.codehaus.org/browse/MNG-3678?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

John Casey updated MNG-3678:
----------------------------

    Fix Version/s: 2.0.11

we can take a closer look at this for 2.0.11, but it's part of the original design of Maven that repositories are aggregated from dependency POMs in order to help search for the next level of transitive dependencies. These dependency-specified repositories are only used for resolving the transitive dependency closure for that artifact's own dependencies, not for sibling artifacts, etc.

The same goes for plugins, IIRC.

In light of this, I'm not sure what you're reporting is actually an error.

> Maven downloads from snapshot repos even when no snapshot repository is in the pom
> ----------------------------------------------------------------------------------
>
>                 Key: MNG-3678
>                 URL: http://jira.codehaus.org/browse/MNG-3678
>             Project: Maven 2
>          Issue Type: Bug
>    Affects Versions: 2.0.9
>         Environment: Win XP
>            Reporter: Julien HENRY
>             Fix For: 2.0.11
>
>         Attachments: pom.xml, stack.txt
>
>
> Easy to reproduce. Start with an empty local repository (rename ~/.m2/repository) and use a very simple pom.xml. The tips is to use a pom project instead of a jar project. Now run mvn clean install.
> In the log, you will see:
> ...
> Downloading: http://snapshots.repository.codehaus.org/org/mortbay/jetty/servlet-api-2.5/6.1.5/servlet-api-2.5-6.1.5.jar
> Downloading: http://people.apache.org/repo/m2-snapshot-repository//org/mortbay/jetty/servlet-api-2.5/6.1.5/servlet-api-2.5-6.1.5.jar
> ...
> I think there are some <repository> sections in some pom.xml on Ibiblio that still contain snapshot repositories.

--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.codehaus.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

    [ http://jira.codehaus.org/browse/MNG-3678?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=143214#action_143214 ]

Julien HENRY commented on MNG-3678:
-----------------------------------

I understand the concept but I think it is an error that some released plugins or dependencies (especially Maven default one) are still referencing a snapshot repository. Also I thought Ibilio policy was to be self-containing. So I think no external repository should be allowed in pom.xml in Ibiblio.

> Maven downloads from snapshot repos even when no snapshot repository is in the pom
> ----------------------------------------------------------------------------------
>
>                 Key: MNG-3678
>                 URL: http://jira.codehaus.org/browse/MNG-3678
>             Project: Maven 2
>          Issue Type: Bug
>    Affects Versions: 2.0.9
>         Environment: Win XP
>            Reporter: Julien HENRY
>             Fix For: 2.0.11
>
>         Attachments: pom.xml, stack.txt
>
>
> Easy to reproduce. Start with an empty local repository (rename ~/.m2/repository) and use a very simple pom.xml. The tips is to use a pom project instead of a jar project. Now run mvn clean install.
> In the log, you will see:
> ...
> Downloading: http://snapshots.repository.codehaus.org/org/mortbay/jetty/servlet-api-2.5/6.1.5/servlet-api-2.5-6.1.5.jar
> Downloading: http://people.apache.org/repo/m2-snapshot-repository//org/mortbay/jetty/servlet-api-2.5/6.1.5/servlet-api-2.5-6.1.5.jar
> ...
> I think there are some <repository> sections in some pom.xml on Ibiblio that still contain snapshot repositories.

--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.codehaus.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira