[
https://issues.apache.org/jira/browse/MNG-8180?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17864977#comment-17864977
]
ASF GitHub Bot commented on MNG-8180:
-------------------------------------
cstamas opened a new pull request, #1611:
URL: https://github.com/apache/maven/pull/1611
Resolver handles transparently the repository metadata, and in case of
plugins it peeks into META-INF/maven/plugin.xml of given artifact JAR to figure
out needed metadata bits (prefix, name, etc).
But, this was done "blindly", while it is expected that GA of JAR artifact
without classifier (requirement for maven plugins) and GA in embedded plugin
metadata must be same.
Decision here is to fail hard, prevent this being installed and deployed, as
this is most probably wrong (unsure what maven-indexer or even Sonatype search
would do in this case).
---
https://issues.apache.org/jira/browse/MNG-8180
> Resolver will blindly assume it is deploying a plugin by presence of
> META-INF/maven/plugins.xml in JAR
> ------------------------------------------------------------------------------------------------------
>
> Key: MNG-8180
> URL: https://issues.apache.org/jira/browse/MNG-8180
> Project: Maven
> Issue Type: Bug
> Components: Artifacts and Repositories
> Affects Versions: 3.9.0, 3.9.1, 3.9.2, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7,
> 3.9.8
> Reporter: Tamas Cservenak
> Priority: Major
> Fix For: 3.9.x-candidate, 4.0.x-candidate
>
>
> Resolver will generate plugin metadata based on contents of
> META-INF/maven/plugins.xml file, that for example in case of shaded JAR may
> be totally off.
> Circumvention: exclude this file from JAR.
> All Maven 3.9.x and 4.x are affected.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
