ascheman commented on issue #13100: URL: https://github.com/apache/maven/issues/13100#issuecomment-5663727201
One more data point for the record, from a side thread with @cstamas: a fully legitimate pattern is two alternating profiles — e.g. `public` vs `inhouse`, each declaring its own `<repositories>` (inhouse → an MRM). A blanket "strip all profile repositories" breaks exactly that. Scoping nuance so we're precise: this only bites when such profiles live in a **repository-resolved** POM (a dependency's own, built at `CONSUMER_DEPENDENCY`); a consumer's own project/settings profiles are fully evaluated and unaffected. So the problem space is specifically "repositories a *dependency* contributes via a profile". For what it's worth, your redefine-detection framing — honor declared repos, scrutinize *re*definition of an existing repository (especially `central`), warn/fail — looks like the right axis to me (cf. #428). Leaving the shape to you. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
