[
https://issues.apache.org/jira/browse/MNG-7373?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17769743#comment-17769743
]
Tamas Cservenak commented on MNG-7373:
--------------------------------------
Maven when reaches out to remote artifacts uses locally provided information
(even for packaging), NOT the remote one. In other words, if you do not want to
download then JAR, then specify.
In other words, Resolver has no notion of "POM" (that is a Maven term), all
that Resolver sees from POM is this:
[https://github.com/apache/maven-resolver/blob/master/maven-resolver-api/src/main/java/org/eclipse/aether/resolution/ArtifactDescriptorResult.java]
(and there is no packaging, nor is expected to be).
> Maven should not attempt to download the jar when <packaging>pom</packaging>
> ----------------------------------------------------------------------------
>
> Key: MNG-7373
> URL: https://issues.apache.org/jira/browse/MNG-7373
> Project: Maven
> Issue Type: Improvement
> Reporter: S L
> Priority: Major
> Fix For: waiting-for-feedback, wontfix-candidate
>
>
> Hello,
> maybe a corner case of what exactly should be part of a "relocation pom"
> ([https://maven.apache.org/guides/mini/guide-relocation.html]), but I created
> a release just consisting of the relocation-info
> ([https://repo1.maven.org/maven2/pl/project13/maven/git-commit-id-plugin/4.9.9/git-commit-id-plugin-4.9.9.pom])
> as type `<packaging>pom</packaging>` (since I only wanted to publish the
> relocation information).
> Using this depdendency.e.g. via:
> {code}
> <build>
> <plugins>
> <plugin>
> <groupId>pl.project13.maven</groupId>
> <artifactId>git-commit-id-plugin</artifactId>
> <version>4.9.9</version>
> </plugin>
> </plugins>
> </build>
> {code}
> yields in the incorrect attempt of downloading a JAR-File from the new
> repository location:
> {code}
> [INFO] Building Git Commit Id Plugin Maven Mojo Debugging 0.0.3-SNAPSHOT
> [1/3]
> [INFO] --------------------------------[ pom
> ]---------------------------------
> Downloading from central-secure:
> https://repo.maven.apache.org/maven2/io/github/git-commit-id/git-commit-id-maven-plugin/4.9.9/git-commit-id-maven-plugin-4.9.9.pom
> [WARNING] The POM for
> io.github.git-commit-id:git-commit-id-maven-plugin:jar:4.9.9 is missing, no
> dependency information available
> Downloading from central-secure:
> https://repo.maven.apache.org/maven2/io/github/git-commit-id/git-commit-id-maven-plugin/4.9.9/git-commit-id-maven-plugin-4.9.9.jar
> [INFO]
> ------------------------------------------------------------------------
> [INFO] Reactor Summary for Git Commit Id Plugin Maven Mojo Debugging
> 0.0.3-SNAPSHOT:
> [INFO]
> [INFO] Git Commit Id Plugin Maven Mojo Debugging .......... FAILURE [ 0.850
> s]
> [INFO] submodule-one ...................................... SKIPPED
> [INFO] submodule-two ...................................... SKIPPED
> [INFO]
> ------------------------------------------------------------------------
> [INFO] BUILD FAILURE
> [INFO]
> ------------------------------------------------------------------------
> [INFO] Total time: 1.000 s
> [INFO] Finished at: 2021-07-12T21:42:15+02:00
> [INFO]
> ------------------------------------------------------------------------
> [ERROR] Plugin pl.project13.maven:git-commit-id-plugin:4.9.9 or one of its
> dependencies could not be resolved: Could not find artifact
> io.github.git-commit-id:git-commit-id-maven-plugin:jar:4.9.9 in
> central-secure (https://repo.maven.apache.org/maven2) -> [Help 1]
> {code}
> IMHO Maven should not even try to search for a jar when
> `<packaging>pom</packaging>`. Simply raise an error that the package was
> relocated. the new location is at least detected, since it tries to download
> the artifact from a new location.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
