[jira] [Commented] (MRESOLVER-483) PreorderNodeListGenerator bug: may print trailing ":"

2024-01-26 Thread Tamas Cservenak (Jira)


[ 
https://issues.apache.org/jira/browse/MRESOLVER-483?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17811411#comment-17811411
 ] 

Tamas Cservenak commented on MRESOLVER-483:
---

Same stands for NodeListGenerator in Resolver 2

> PreorderNodeListGenerator bug: may print trailing ":"
> -
>
> Key: MRESOLVER-483
> URL: https://issues.apache.org/jira/browse/MRESOLVER-483
> Project: Maven Resolver
>  Issue Type: Bug
>  Components: Resolver
>Reporter: Tamas Cservenak
>Priority: Major
> Fix For: 2.0.0, 1.9.19, 2.0.0-alpha-8
>
>
> Example:
> {noformat}
> prompt> classpath eu.maveniverse.maven.mima:cli:2.4.6
> /home/cstamas/.m2/repository-oss/eu/maveniverse/maven/mima/cli/2.4.6/cli-2.4.6.jar:/home/cstamas/.m2/repository-oss/eu/maveniverse/maven/mima/context/2.4.6/context-2.4.6.jar:/home/cstamas/.m2/repository-oss/org/apache/maven/resolver/maven-resolver-api/1.9.18/maven-resolver-api-1.9.18.jar:/home/cstamas/.m2/repository-oss/org/apache/maven/resolver/maven-resolver-util/1.9.18/maven-resolver-util-1.9.18.jar:/home/cstamas/.m2/repository-oss/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36.jar:/home/cstamas/.m2/repository-oss/info/picocli/picocli/4.7.5/picocli-4.7.5.jar:/home/cstamas/.m2/repository-oss/info/picocli/picocli-shell-jline3/4.7.5/picocli-shell-jline3-4.7.5.jar:/home/cstamas/.m2/repository-oss/org/jline/jline/3.23.0/jline-3.23.0.jar:/home/cstamas/.m2/repository-oss/org/fusesource/jansi/jansi/2.4.1/jansi-2.4.1.jar:/home/cstamas/.m2/repository-oss/eu/maveniverse/maven/mase/search-api/1.0.1/search-api-1.0.1.jar:/home/cstamas/.m2/repository-oss/eu/maveniverse/maven/mase/search-backend-remoterepository/1.0.1/search-backend-remoterepository-1.0.1.jar:/home/cstamas/.m2/repository-oss/org/jsoup/jsoup/1.17.1/jsoup-1.17.1.jar:/home/cstamas/.m2/repository-oss/eu/maveniverse/maven/mase/search-backend-smo/1.0.1/search-backend-smo-1.0.1.jar:/home/cstamas/.m2/repository-oss/com/google/code/gson/gson/2.10.1/gson-2.10.1.jar:
>  {noformat}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Updated] (MRESOLVER-482) Seems config "aether.syncContext.named.retry" has no effect

2024-01-26 Thread Tamas Cservenak (Jira)


 [ 
https://issues.apache.org/jira/browse/MRESOLVER-482?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Tamas Cservenak updated MRESOLVER-482:
--
Fix Version/s: (was: 2.0.0)
   (was: 1.9.19)
   (was: 2.0.0-alpha-8)

> Seems config "aether.syncContext.named.retry" has no effect
> ---
>
> Key: MRESOLVER-482
> URL: https://issues.apache.org/jira/browse/MRESOLVER-482
> Project: Maven Resolver
>  Issue Type: Bug
>  Components: Resolver
>Affects Versions: 1.9.18
>Reporter: Tamas Cservenak
>Priority: Major
>




--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Created] (MRESOLVER-483) PreorderNodeListGenerator bug: may print trailing ":"

2024-01-26 Thread Tamas Cservenak (Jira)
Tamas Cservenak created MRESOLVER-483:
-

 Summary: PreorderNodeListGenerator bug: may print trailing ":"
 Key: MRESOLVER-483
 URL: https://issues.apache.org/jira/browse/MRESOLVER-483
 Project: Maven Resolver
  Issue Type: Bug
  Components: Resolver
Reporter: Tamas Cservenak
 Fix For: 2.0.0, 1.9.19, 2.0.0-alpha-8


Example:
{noformat}
prompt> classpath eu.maveniverse.maven.mima:cli:2.4.6
/home/cstamas/.m2/repository-oss/eu/maveniverse/maven/mima/cli/2.4.6/cli-2.4.6.jar:/home/cstamas/.m2/repository-oss/eu/maveniverse/maven/mima/context/2.4.6/context-2.4.6.jar:/home/cstamas/.m2/repository-oss/org/apache/maven/resolver/maven-resolver-api/1.9.18/maven-resolver-api-1.9.18.jar:/home/cstamas/.m2/repository-oss/org/apache/maven/resolver/maven-resolver-util/1.9.18/maven-resolver-util-1.9.18.jar:/home/cstamas/.m2/repository-oss/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36.jar:/home/cstamas/.m2/repository-oss/info/picocli/picocli/4.7.5/picocli-4.7.5.jar:/home/cstamas/.m2/repository-oss/info/picocli/picocli-shell-jline3/4.7.5/picocli-shell-jline3-4.7.5.jar:/home/cstamas/.m2/repository-oss/org/jline/jline/3.23.0/jline-3.23.0.jar:/home/cstamas/.m2/repository-oss/org/fusesource/jansi/jansi/2.4.1/jansi-2.4.1.jar:/home/cstamas/.m2/repository-oss/eu/maveniverse/maven/mase/search-api/1.0.1/search-api-1.0.1.jar:/home/cstamas/.m2/repository-oss/eu/maveniverse/maven/mase/search-backend-remoterepository/1.0.1/search-backend-remoterepository-1.0.1.jar:/home/cstamas/.m2/repository-oss/org/jsoup/jsoup/1.17.1/jsoup-1.17.1.jar:/home/cstamas/.m2/repository-oss/eu/maveniverse/maven/mase/search-backend-smo/1.0.1/search-backend-smo-1.0.1.jar:/home/cstamas/.m2/repository-oss/com/google/code/gson/gson/2.10.1/gson-2.10.1.jar:
 {noformat}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Comment Edited] (MPMD-391) Log what developers care about and not what they don't

2024-01-26 Thread Elliotte Rusty Harold (Jira)


[ 
https://issues.apache.org/jira/browse/MPMD-391?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17806570#comment-17806570
 ] 

Elliotte Rusty Harold edited comment on MPMD-391 at 1/26/24 8:40 PM:
-

Yes, this crosses a lot of projects. It does surface here.

Also printing the actual issue PMD flagged should also be in our control. Even 
if PMD only writes that into a file, we should parse the data out of that file 
and print the problem here. 


was (Author: elharo):
Yes, this crosses a lot of projects. It does surface here.

Also printing the actual issue PMD flagged should also be in out control. Even 
if PMD only writes that into a file, we should parse the data out of that file 
and print the problem here. 

> Log what developers care about and not what they don't
> --
>
> Key: MPMD-391
> URL: https://issues.apache.org/jira/browse/MPMD-391
> Project: Maven PMD Plugin
>  Issue Type: Improvement
>Reporter: Elliotte Rusty Harold
>Priority: Major
>
> Here's output from a recent PMD plugin run that failed:
> [INFO] >>> maven-pmd-plugin:3.21.2:check (default-cli) > :pmd @ commons-io >>>
> [INFO] 
> [INFO] --- maven-pmd-plugin:3.21.2:pmd (pmd) @ commons-io ---
> [INFO] PMD version: 6.55.0
> [INFO] Rendering content with 
> org.apache.maven.skins:maven-default-skin:jar:1.3 skin.
> [INFO] 
> [INFO] <<< maven-pmd-plugin:3.21.2:check (default-cli) < :pmd @ commons-io <<<
> [INFO] 
> [INFO] 
> [INFO] --- maven-pmd-plugin:3.21.2:check (default-cli) @ commons-io ---
> [INFO] PMD version: 6.55.0
> [INFO] 
> 
> [INFO] BUILD FAILURE
> [INFO] 
> 
> [INFO] Total time:  05:22 min
> [INFO] Finished at: 2024-01-14T14:11:30Z
> [INFO] 
> 
> Error:  Failed to execute goal 
> org.apache.maven.plugins:maven-pmd-plugin:3.21.2:check (default-cli) on 
> project commons-io: You have 1 PMD violation. For more details see: 
> /home/runner/work/commons-io/commons-io/target/pmd.xml -> [Help 1]
> Error:  
> Error:  To see the full stack trace of the errors, re-run Maven with the -e 
> switch.
> Error:  Re-run Maven using the -X switch to enable full debug logging.
> Error:  
> Error:  For more information about the errors and possible solutions, please 
> read the following articles:
> Error:  [Help 1] 
> http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
> Error: Process completed with exit code 1.
> Things I don't care about that are printed:
> * PMD version
> * Doxia skin
> * Blank lines
> * Total time 
> * Timestamp when it finished
> * Generic information about Mojo failures
> * Exit code from Mojo
> The one thing I care about:
> * The actual error that caused the failure
> Everything in the first list can be hidden in some random log file no one 
> will ever look at. Everything in the second list should be front and center. 
> Instead Maven gets this exactly backwards,



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Assigned] (MNG-8000) DefaultArtifact lacks constructors for version and optional

2024-01-26 Thread Tamas Cservenak (Jira)


 [ 
https://issues.apache.org/jira/browse/MNG-8000?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Tamas Cservenak reassigned MNG-8000:


Assignee: Guillaume Nodet

> DefaultArtifact lacks constructors for version and optional
> ---
>
> Key: MNG-8000
> URL: https://issues.apache.org/jira/browse/MNG-8000
> Project: Maven
>  Issue Type: Task
>  Components: Core
>Affects Versions: 4.0.0-alpha-10
>Reporter: Zhongming Hua
>Assignee: Guillaume Nodet
>Priority: Minor
> Fix For: 4.0.0-alpha-12
>
>




--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Created] (MNG-8031) Backport: Make Maven transfer listener used with Resolver more concurrent friendly

2024-01-26 Thread Tamas Cservenak (Jira)
Tamas Cservenak created MNG-8031:


 Summary: Backport: Make Maven transfer listener used with Resolver 
more concurrent friendly
 Key: MNG-8031
 URL: https://issues.apache.org/jira/browse/MNG-8031
 Project: Maven
  Issue Type: Improvement
Reporter: Tamas Cservenak
 Fix For: 3.9.7


Backport of MNG-8007



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Updated] (MNG-8030) Backport: Add ability to ignore dependency repositories: mvn -itr

2024-01-26 Thread Tamas Cservenak (Jira)


 [ 
https://issues.apache.org/jira/browse/MNG-8030?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Tamas Cservenak updated MNG-8030:
-
Summary: Backport: Add ability to ignore dependency repositories: mvn -itr  
(was: Backport: Add ability to ignore transitive dependency repositories: mvn 
-itr)

> Backport: Add ability to ignore dependency repositories: mvn -itr
> -
>
> Key: MNG-8030
> URL: https://issues.apache.org/jira/browse/MNG-8030
> Project: Maven
>  Issue Type: Improvement
>Reporter: Tamas Cservenak
>Priority: Major
> Fix For: 3.9.7
>
>
> Backport of MNG-7980



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Created] (MNG-8030) Backport: Add ability to ignore transitive dependency repositories: mvn -itr

2024-01-26 Thread Tamas Cservenak (Jira)
Tamas Cservenak created MNG-8030:


 Summary: Backport: Add ability to ignore transitive dependency 
repositories: mvn -itr
 Key: MNG-8030
 URL: https://issues.apache.org/jira/browse/MNG-8030
 Project: Maven
  Issue Type: Improvement
Reporter: Tamas Cservenak
 Fix For: 3.9.7


Backport of MNG-7980



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Commented] (MNG-7954) Provide a cleaner DI api

2024-01-26 Thread ASF GitHub Bot (Jira)


[ 
https://issues.apache.org/jira/browse/MNG-7954?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17811379#comment-17811379
 ] 

ASF GitHub Bot commented on MNG-7954:
-

rmannibucau commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912570522

   Yes think extensions are in scope there and don't think scope is the biggest 
code (maybe guice made it verbose but the CDI way is actually quite light - 
`Context` usage in subclass proxies which can be done at build time, even if it 
is just dumping asm one at build time and not using an annot proc or sthg more 
build oriented). But if we want to split we can maybe start by param injection 
only.




> Provide a cleaner DI api
> 
>
> Key: MNG-7954
> URL: https://issues.apache.org/jira/browse/MNG-7954
> Project: Maven
>  Issue Type: New Feature
>  Components: API
>Reporter: Guillaume Nodet
>Priority: Major
> Fix For: 4.0.0
>
>
> With https://issues.apache.org/jira/browse/MNG-7947  the {{jakarta.inject}} 
> package has been brought into the API.
> We need a cleaner way and not depend on any third party library if possible.
> The 
> [{{SessionScope}}|https://github.com/apache/maven/blob/23bca281fcd084ac21d80f5a2950dcee30a19080/maven-core/src/main/java/org/apache/maven/session/scope/internal/SessionScope.java#L123-L125]
>  would also require some cleaning to avoid having to rely on 
> {{{}(org.eclipse.sisu|javax.enterprise.inject|jakarta.enterprise.inject).Typed{}}}.
> For complete DI, we may also miss the sisu annotations 
> ({{{}PostConstruct{}}}, {{PreDestroy}} and {{Priority}} and 
> {{{}EagerSingleton{}}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] [MNG-7954] New dependency injection mechanism [maven]

2024-01-26 Thread via GitHub


rmannibucau commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912570522

   Yes think extensions are in scope there and don't think scope is the biggest 
code (maybe guice made it verbose but the CDI way is actually quite light - 
`Context` usage in subclass proxies which can be done at build time, even if it 
is just dumping asm one at build time and not using an annot proc or sthg more 
build oriented). But if we want to split we can maybe start by param injection 
only.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Commented] (MNG-7954) Provide a cleaner DI api

2024-01-26 Thread ASF GitHub Bot (Jira)


[ 
https://issues.apache.org/jira/browse/MNG-7954?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17811378#comment-17811378
 ] 

ASF GitHub Bot commented on MNG-7954:
-

cstamas commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912564200

   Unless, as you mention, is an extension... and we do have quite some of 
those.




> Provide a cleaner DI api
> 
>
> Key: MNG-7954
> URL: https://issues.apache.org/jira/browse/MNG-7954
> Project: Maven
>  Issue Type: New Feature
>  Components: API
>Reporter: Guillaume Nodet
>Priority: Major
> Fix For: 4.0.0
>
>
> With https://issues.apache.org/jira/browse/MNG-7947  the {{jakarta.inject}} 
> package has been brought into the API.
> We need a cleaner way and not depend on any third party library if possible.
> The 
> [{{SessionScope}}|https://github.com/apache/maven/blob/23bca281fcd084ac21d80f5a2950dcee30a19080/maven-core/src/main/java/org/apache/maven/session/scope/internal/SessionScope.java#L123-L125]
>  would also require some cleaning to avoid having to rely on 
> {{{}(org.eclipse.sisu|javax.enterprise.inject|jakarta.enterprise.inject).Typed{}}}.
> For complete DI, we may also miss the sisu annotations 
> ({{{}PostConstruct{}}}, {{PreDestroy}} and {{Priority}} and 
> {{{}EagerSingleton{}}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] [MNG-7954] New dependency injection mechanism [maven]

2024-01-26 Thread via GitHub


gnodet commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912563154

   > Think we should start minimalistic, maven IoC need is actually pretty low 
- mainly bean definition + overriding - so less we keep better it is in terms 
of maintenance. Rewriting from scratch gives the opportunity to drop guice and 
sisu at some point too so can be quite promishing if we manage to make 
plexus-world optional (realm = TCCL) but this is likely mvn 6 or 7 ;).
   
   Yeah, I think I'll even drop support for scopes for now, we don't really 
need it for plugins.  Those are only needed when dealing with extensions or 
maven-core, as plugins are always bound to the mojo execution.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Commented] (MNG-7954) Provide a cleaner DI api

2024-01-26 Thread ASF GitHub Bot (Jira)


[ 
https://issues.apache.org/jira/browse/MNG-7954?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17811377#comment-17811377
 ] 

ASF GitHub Bot commented on MNG-7954:
-

gnodet commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912563154

   > Think we should start minimalistic, maven IoC need is actually pretty low 
- mainly bean definition + overriding - so less we keep better it is in terms 
of maintenance. Rewriting from scratch gives the opportunity to drop guice and 
sisu at some point too so can be quite promishing if we manage to make 
plexus-world optional (realm = TCCL) but this is likely mvn 6 or 7 ;).
   
   Yeah, I think I'll even drop support for scopes for now, we don't really 
need it for plugins.  Those are only needed when dealing with extensions or 
maven-core, as plugins are always bound to the mojo execution.




> Provide a cleaner DI api
> 
>
> Key: MNG-7954
> URL: https://issues.apache.org/jira/browse/MNG-7954
> Project: Maven
>  Issue Type: New Feature
>  Components: API
>Reporter: Guillaume Nodet
>Priority: Major
> Fix For: 4.0.0
>
>
> With https://issues.apache.org/jira/browse/MNG-7947  the {{jakarta.inject}} 
> package has been brought into the API.
> We need a cleaner way and not depend on any third party library if possible.
> The 
> [{{SessionScope}}|https://github.com/apache/maven/blob/23bca281fcd084ac21d80f5a2950dcee30a19080/maven-core/src/main/java/org/apache/maven/session/scope/internal/SessionScope.java#L123-L125]
>  would also require some cleaning to avoid having to rely on 
> {{{}(org.eclipse.sisu|javax.enterprise.inject|jakarta.enterprise.inject).Typed{}}}.
> For complete DI, we may also miss the sisu annotations 
> ({{{}PostConstruct{}}}, {{PreDestroy}} and {{Priority}} and 
> {{{}EagerSingleton{}}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] [MNG-7954] New dependency injection mechanism [maven]

2024-01-26 Thread via GitHub


cstamas commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912564200

   Unless, as you mention, is an extension... and we do have quite some of 
those.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Commented] (MNG-7954) Provide a cleaner DI api

2024-01-26 Thread ASF GitHub Bot (Jira)


[ 
https://issues.apache.org/jira/browse/MNG-7954?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17811376#comment-17811376
 ] 

ASF GitHub Bot commented on MNG-7954:
-

rmannibucau commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912558280

   Think we should start minimalistic, maven IoC need is actually pretty low - 
mainly bean definition + overriding - so less we keep better it is in terms of 
maintenance.
   Rewriting from scratch gives the opportunity to drop guice and sisu at some 
point too so can be quite promishing if we manage to make plexus-world optional 
(realm = TCCL) but this is likely mvn 6 or 7 ;).




> Provide a cleaner DI api
> 
>
> Key: MNG-7954
> URL: https://issues.apache.org/jira/browse/MNG-7954
> Project: Maven
>  Issue Type: New Feature
>  Components: API
>Reporter: Guillaume Nodet
>Priority: Major
> Fix For: 4.0.0
>
>
> With https://issues.apache.org/jira/browse/MNG-7947  the {{jakarta.inject}} 
> package has been brought into the API.
> We need a cleaner way and not depend on any third party library if possible.
> The 
> [{{SessionScope}}|https://github.com/apache/maven/blob/23bca281fcd084ac21d80f5a2950dcee30a19080/maven-core/src/main/java/org/apache/maven/session/scope/internal/SessionScope.java#L123-L125]
>  would also require some cleaning to avoid having to rely on 
> {{{}(org.eclipse.sisu|javax.enterprise.inject|jakarta.enterprise.inject).Typed{}}}.
> For complete DI, we may also miss the sisu annotations 
> ({{{}PostConstruct{}}}, {{PreDestroy}} and {{Priority}} and 
> {{{}EagerSingleton{}}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] [MNG-7954] New dependency injection mechanism [maven]

2024-01-26 Thread via GitHub


rmannibucau commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912558280

   Think we should start minimalistic, maven IoC need is actually pretty low - 
mainly bean definition + overriding - so less we keep better it is in terms of 
maintenance.
   Rewriting from scratch gives the opportunity to drop guice and sisu at some 
point too so can be quite promishing if we manage to make plexus-world optional 
(realm = TCCL) but this is likely mvn 6 or 7 ;).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Commented] (MNG-7954) Provide a cleaner DI api

2024-01-26 Thread ASF GitHub Bot (Jira)


[ 
https://issues.apache.org/jira/browse/MNG-7954?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17811374#comment-17811374
 ] 

ASF GitHub Bot commented on MNG-7954:
-

cstamas commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912543268

   Do we want something like `@Description` is? Or it was added to Sisu only as 
Plexus XML had "component description"? In fact, am unaware of any use of it, 
but still...




> Provide a cleaner DI api
> 
>
> Key: MNG-7954
> URL: https://issues.apache.org/jira/browse/MNG-7954
> Project: Maven
>  Issue Type: New Feature
>  Components: API
>Reporter: Guillaume Nodet
>Priority: Major
> Fix For: 4.0.0
>
>
> With https://issues.apache.org/jira/browse/MNG-7947  the {{jakarta.inject}} 
> package has been brought into the API.
> We need a cleaner way and not depend on any third party library if possible.
> The 
> [{{SessionScope}}|https://github.com/apache/maven/blob/23bca281fcd084ac21d80f5a2950dcee30a19080/maven-core/src/main/java/org/apache/maven/session/scope/internal/SessionScope.java#L123-L125]
>  would also require some cleaning to avoid having to rely on 
> {{{}(org.eclipse.sisu|javax.enterprise.inject|jakarta.enterprise.inject).Typed{}}}.
> For complete DI, we may also miss the sisu annotations 
> ({{{}PostConstruct{}}}, {{PreDestroy}} and {{Priority}} and 
> {{{}EagerSingleton{}}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] [MNG-7954] New dependency injection mechanism [maven]

2024-01-26 Thread via GitHub


cstamas commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912543268

   Do we want something like `@Description` is? Or it was added to Sisu only as 
Plexus XML had "component description"? In fact, am unaware of any use of it, 
but still...


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Commented] (MPMD-391) Log what developers care about and not what they don't

2024-01-26 Thread Andreas Dangel (Jira)


[ 
https://issues.apache.org/jira/browse/MPMD-391?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17811355#comment-17811355
 ] 

Andreas Dangel commented on MPMD-391:
-

To see, why the build failed, the property 
[printFailingErrors|https://maven.apache.org/plugins/maven-pmd-plugin/check-mojo.html#printFailingErrors]
 can be set - which is by default disabled (not sure why).
This however just adds more output and doesn't remove unnecessary clutter...

> Log what developers care about and not what they don't
> --
>
> Key: MPMD-391
> URL: https://issues.apache.org/jira/browse/MPMD-391
> Project: Maven PMD Plugin
>  Issue Type: Improvement
>Reporter: Elliotte Rusty Harold
>Priority: Major
>
> Here's output from a recent PMD plugin run that failed:
> [INFO] >>> maven-pmd-plugin:3.21.2:check (default-cli) > :pmd @ commons-io >>>
> [INFO] 
> [INFO] --- maven-pmd-plugin:3.21.2:pmd (pmd) @ commons-io ---
> [INFO] PMD version: 6.55.0
> [INFO] Rendering content with 
> org.apache.maven.skins:maven-default-skin:jar:1.3 skin.
> [INFO] 
> [INFO] <<< maven-pmd-plugin:3.21.2:check (default-cli) < :pmd @ commons-io <<<
> [INFO] 
> [INFO] 
> [INFO] --- maven-pmd-plugin:3.21.2:check (default-cli) @ commons-io ---
> [INFO] PMD version: 6.55.0
> [INFO] 
> 
> [INFO] BUILD FAILURE
> [INFO] 
> 
> [INFO] Total time:  05:22 min
> [INFO] Finished at: 2024-01-14T14:11:30Z
> [INFO] 
> 
> Error:  Failed to execute goal 
> org.apache.maven.plugins:maven-pmd-plugin:3.21.2:check (default-cli) on 
> project commons-io: You have 1 PMD violation. For more details see: 
> /home/runner/work/commons-io/commons-io/target/pmd.xml -> [Help 1]
> Error:  
> Error:  To see the full stack trace of the errors, re-run Maven with the -e 
> switch.
> Error:  Re-run Maven using the -X switch to enable full debug logging.
> Error:  
> Error:  For more information about the errors and possible solutions, please 
> read the following articles:
> Error:  [Help 1] 
> http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
> Error: Process completed with exit code 1.
> Things I don't care about that are printed:
> * PMD version
> * Doxia skin
> * Blank lines
> * Total time 
> * Timestamp when it finished
> * Generic information about Mojo failures
> * Exit code from Mojo
> The one thing I care about:
> * The actual error that caused the failure
> Everything in the first list can be hidden in some random log file no one 
> will ever look at. Everything in the second list should be front and center. 
> Instead Maven gets this exactly backwards,



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Commented] (MNG-7954) Provide a cleaner DI api

2024-01-26 Thread ASF GitHub Bot (Jira)


[ 
https://issues.apache.org/jira/browse/MNG-7954?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17811352#comment-17811352
 ] 

ASF GitHub Bot commented on MNG-7954:
-

gnodet commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912417252

   > Am just worried that we end up again as we did with old plexus: was our, 
but began to rot from one point... I'd be happies if we could simply circumvent 
this by something like 
[eclipse/sisu.inject#103](https://github.com/eclipse/sisu.inject/issues/103)
   
   Feel free to give it a try, but I could not find an easy way without 
rewriting everything...




> Provide a cleaner DI api
> 
>
> Key: MNG-7954
> URL: https://issues.apache.org/jira/browse/MNG-7954
> Project: Maven
>  Issue Type: New Feature
>  Components: API
>Reporter: Guillaume Nodet
>Priority: Major
> Fix For: 4.0.0
>
>
> With https://issues.apache.org/jira/browse/MNG-7947  the {{jakarta.inject}} 
> package has been brought into the API.
> We need a cleaner way and not depend on any third party library if possible.
> The 
> [{{SessionScope}}|https://github.com/apache/maven/blob/23bca281fcd084ac21d80f5a2950dcee30a19080/maven-core/src/main/java/org/apache/maven/session/scope/internal/SessionScope.java#L123-L125]
>  would also require some cleaning to avoid having to rely on 
> {{{}(org.eclipse.sisu|javax.enterprise.inject|jakarta.enterprise.inject).Typed{}}}.
> For complete DI, we may also miss the sisu annotations 
> ({{{}PostConstruct{}}}, {{PreDestroy}} and {{Priority}} and 
> {{{}EagerSingleton{}}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] [MNG-7954] New dependency injection mechanism [maven]

2024-01-26 Thread via GitHub


gnodet commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912417252

   > Am just worried that we end up again as we did with old plexus: was our, 
but began to rot from one point... I'd be happies if we could simply circumvent 
this by something like 
[eclipse/sisu.inject#103](https://github.com/eclipse/sisu.inject/issues/103)
   
   Feel free to give it a try, but I could not find an easy way without 
rewriting everything...


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Commented] (MNG-7954) Provide a cleaner DI api

2024-01-26 Thread ASF GitHub Bot (Jira)


[ 
https://issues.apache.org/jira/browse/MNG-7954?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17811334#comment-17811334
 ] 

ASF GitHub Bot commented on MNG-7954:
-

cstamas commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912315596

   Am just worried that we end up again as we did with old plexus: was our, but 
began to rot from one point... I'd be happies if we could simply circumvent 
this by something like https://github.com/eclipse/sisu.inject/issues/103




> Provide a cleaner DI api
> 
>
> Key: MNG-7954
> URL: https://issues.apache.org/jira/browse/MNG-7954
> Project: Maven
>  Issue Type: New Feature
>  Components: API
>Reporter: Guillaume Nodet
>Priority: Major
> Fix For: 4.0.0
>
>
> With https://issues.apache.org/jira/browse/MNG-7947  the {{jakarta.inject}} 
> package has been brought into the API.
> We need a cleaner way and not depend on any third party library if possible.
> The 
> [{{SessionScope}}|https://github.com/apache/maven/blob/23bca281fcd084ac21d80f5a2950dcee30a19080/maven-core/src/main/java/org/apache/maven/session/scope/internal/SessionScope.java#L123-L125]
>  would also require some cleaning to avoid having to rely on 
> {{{}(org.eclipse.sisu|javax.enterprise.inject|jakarta.enterprise.inject).Typed{}}}.
> For complete DI, we may also miss the sisu annotations 
> ({{{}PostConstruct{}}}, {{PreDestroy}} and {{Priority}} and 
> {{{}EagerSingleton{}}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] [MNG-7954] New dependency injection mechanism [maven]

2024-01-26 Thread via GitHub


cstamas commented on PR #1393:
URL: https://github.com/apache/maven/pull/1393#issuecomment-1912315596

   Am just worried that we end up again as we did with old plexus: was our, but 
began to rot from one point... I'd be happies if we could simply circumvent 
this by something like https://github.com/eclipse/sisu.inject/issues/103


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Commented] (MNG-7954) Provide a cleaner DI api

2024-01-26 Thread ASF GitHub Bot (Jira)


[ 
https://issues.apache.org/jira/browse/MNG-7954?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17811325#comment-17811325
 ] 

ASF GitHub Bot commented on MNG-7954:
-

cstamas commented on code in PR #1393:
URL: https://github.com/apache/maven/pull/1393#discussion_r1467791268


##
api/maven-api-di/src/main/java/org/apache/maven/api/di/Transient.java:
##
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.api.di;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+import java.lang.annotation.Target;
+
+import static java.lang.annotation.ElementType.METHOD;
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+@Target(METHOD)
+@Retention(RUNTIME)
+@Documented
+public @interface Transient {}

Review Comment:
   I believe this is true to Maven Core components, as for example Resolver 
components could not be (nor should be due model) session scoped...





> Provide a cleaner DI api
> 
>
> Key: MNG-7954
> URL: https://issues.apache.org/jira/browse/MNG-7954
> Project: Maven
>  Issue Type: New Feature
>  Components: API
>Reporter: Guillaume Nodet
>Priority: Major
> Fix For: 4.0.0
>
>
> With https://issues.apache.org/jira/browse/MNG-7947  the {{jakarta.inject}} 
> package has been brought into the API.
> We need a cleaner way and not depend on any third party library if possible.
> The 
> [{{SessionScope}}|https://github.com/apache/maven/blob/23bca281fcd084ac21d80f5a2950dcee30a19080/maven-core/src/main/java/org/apache/maven/session/scope/internal/SessionScope.java#L123-L125]
>  would also require some cleaning to avoid having to rely on 
> {{{}(org.eclipse.sisu|javax.enterprise.inject|jakarta.enterprise.inject).Typed{}}}.
> For complete DI, we may also miss the sisu annotations 
> ({{{}PostConstruct{}}}, {{PreDestroy}} and {{Priority}} and 
> {{{}EagerSingleton{}}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] [MNG-7954] New dependency injection mechanism [maven]

2024-01-26 Thread via GitHub


cstamas commented on code in PR #1393:
URL: https://github.com/apache/maven/pull/1393#discussion_r1467791268


##
api/maven-api-di/src/main/java/org/apache/maven/api/di/Transient.java:
##
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.api.di;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+import java.lang.annotation.Target;
+
+import static java.lang.annotation.ElementType.METHOD;
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+@Target(METHOD)
+@Retention(RUNTIME)
+@Documented
+public @interface Transient {}

Review Comment:
   I believe this is true to Maven Core components, as for example Resolver 
components could not be (nor should be due model) session scoped...



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Closed] (MRESOLVER-482) Seems config "aether.syncContext.named.retry" has no effect

2024-01-26 Thread Tamas Cservenak (Jira)


 [ 
https://issues.apache.org/jira/browse/MRESOLVER-482?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Tamas Cservenak closed MRESOLVER-482.
-
Resolution: Not A Problem

This is not a problem.

This was caused by a LEGACY extension: takari-local-repository, that inhibited 
and did something funky with locking. Removed it, and all goes as expected, and 
config works.

> Seems config "aether.syncContext.named.retry" has no effect
> ---
>
> Key: MRESOLVER-482
> URL: https://issues.apache.org/jira/browse/MRESOLVER-482
> Project: Maven Resolver
>  Issue Type: Bug
>  Components: Resolver
>Affects Versions: 1.9.18
>Reporter: Tamas Cservenak
>Priority: Major
> Fix For: 2.0.0, 1.9.19, 2.0.0-alpha-8
>
>




--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] Improve wording on artifact:compare introducing false positives [maven-site]

2024-01-26 Thread via GitHub


lucamolteni commented on code in PR #489:
URL: https://github.com/apache/maven-site/pull/489#discussion_r1467668992


##
content/apt/guides/mini/guide-reproducible-builds.apt:
##
@@ -78,7 +78,10 @@ mvn clean verify artifact:compare
 
  []
 
- Notice that this does NOT really prove that your build is yet reproducible, 
because your build may still suffer from environment leaks (username, current 
directory, ...). But it is easy to do, and prevents basic non-reproducible 
issues like timestamps.
+ Notice that this does NOT really prove that your build is yet reproducible, 
because your build may still suffer from environment leaks (username, current 
directory, ...). 
+ Also not that it might suffer from false positives. Libraries included in 
your build might not support reproducible builds themselves but at the same 
time produce reproducible artifacts.

Review Comment:
   In the previous section you mean. 
   
   Besides you're right, I forgot which task triggered the problem and changed 
the wrong section but for `check-build plan` that still holds right?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Closed] (MPOM-456) Bump surefire/failsafe from 3.2.2 to 3.2.5

2024-01-26 Thread Slawomir Jaranowski (Jira)


 [ 
https://issues.apache.org/jira/browse/MPOM-456?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Slawomir Jaranowski closed MPOM-456.

Resolution: Fixed

> Bump surefire/failsafe from 3.2.2 to 3.2.5
> --
>
> Key: MPOM-456
> URL: https://issues.apache.org/jira/browse/MPOM-456
> Project: Maven POMs
>  Issue Type: Dependency upgrade
>  Components: asf
>Reporter: Slawomir Jaranowski
>Assignee: Slawomir Jaranowski
>Priority: Major
> Fix For: ASF-32
>
>




--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] [MPOM-456] Bump surefire/failsafe from 3.2.2 to 3.2.5 [maven-apache-parent]

2024-01-26 Thread via GitHub


slawekjaranowski merged PR #179:
URL: https://github.com/apache/maven-apache-parent/pull/179


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Created] (MNG-8029) improve documentation of mirror in settings

2024-01-26 Thread Herve Boutemy (Jira)
Herve Boutemy created MNG-8029:
--

 Summary: improve documentation of mirror in settings
 Key: MNG-8029
 URL: https://issues.apache.org/jira/browse/MNG-8029
 Project: Maven
  Issue Type: Improvement
Affects Versions: 4.0.0-alpha-12, 3.9.6
Reporter: Herve Boutemy
 Fix For: 3.9.7, 4.0.0-alpha-13


reading 
https://maven.apache.org/ref/3.9.6/maven-settings/settings.html#class_mirror
and comparing to https://maven.apache.org/guides/mini/guide-mirror-settings.html

model documentation does not explain that mirrorOf is not just an id, but has 
much more flexibility (since Maven versions to be clarified)

and id has no description

it's time to clarify



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Commented] (MNG-7980) Add ability to ignore transitive dependency repositories: mvn -itr

2024-01-26 Thread Herve Boutemy (Jira)


[ 
https://issues.apache.org/jira/browse/MNG-7980?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17811262#comment-17811262
 ] 

Herve Boutemy commented on MNG-7980:


FTR, such a use case of making sure remote repositories are perfectly managed 
is until now done by defining mirrorOf * or external:* in settings: 
https://maven.apache.org/guides/mini/guide-mirror-settings.html

> Add ability to ignore transitive dependency repositories: mvn -itr
> --
>
> Key: MNG-7980
> URL: https://issues.apache.org/jira/browse/MNG-7980
> Project: Maven
>  Issue Type: Improvement
>  Components: Core
>Reporter: Tamas Cservenak
>Assignee: Tamas Cservenak
>Priority: Major
> Fix For: 4.0.0, 4.0.0-alpha-12
>
>
> In certain cases it is valid to ignore repositories introduced by transitive 
> dependencies. They are usually needed, but in certain cases (ie. air gapped 
> environment) they are just causing problems. Even if environment, or the POM 
> itself defines all the repositories needed for the build (so the "superset" 
> of remote repositories that have all the artifacts the build even needs), 
> this requires tuning in case of dependency changes, as new and new 
> repositories may be introduced as dependencies change.
> Ideally, Maven could be instructed to globally ignore any repository 
> introduced by dependency, as POM itself has it call (in controlled fashion) 
> to fulfil all the artifacts.
> => add CLI option to {{mvn}} command: {{-itr}}, 
> {{ignore-transitive-repositories}} 
> https://maven.apache.org/ref/4.0.0-alpha-12/maven-embedder/cli.html



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Updated] (MNG-7980) Add ability to ignore transitive dependency repositories: mvn -itr

2024-01-26 Thread Herve Boutemy (Jira)


 [ 
https://issues.apache.org/jira/browse/MNG-7980?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Herve Boutemy updated MNG-7980:
---
Summary: Add ability to ignore transitive dependency repositories: mvn -itr 
 (was: Add ability to ignore transitive dependency repositories)

> Add ability to ignore transitive dependency repositories: mvn -itr
> --
>
> Key: MNG-7980
> URL: https://issues.apache.org/jira/browse/MNG-7980
> Project: Maven
>  Issue Type: Improvement
>  Components: Core
>Reporter: Tamas Cservenak
>Assignee: Tamas Cservenak
>Priority: Major
> Fix For: 4.0.0, 4.0.0-alpha-12
>
>
> In certain cases it is valid to ignore repositories introduced by transitive 
> dependencies. They are usually needed, but in certain cases (ie. air gapped 
> environment) they are just causing problems. Even if environment, or the POM 
> itself defines all the repositories needed for the build (so the "superset" 
> of remote repositories that have all the artifacts the build even needs), 
> this requires tuning in case of dependency changes, as new and new 
> repositories may be introduced as dependencies change.
> Ideally, Maven could be instructed to globally ignore any repository 
> introduced by dependency, as POM itself has it call (in controlled fashion) 
> to fulfil all the artifacts.
> => add CLI option to {{mvn}} command: {{-itr}}, 
> {{ignore-transitive-repositories}} 
> https://maven.apache.org/ref/4.0.0-alpha-12/maven-embedder/cli.html



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Updated] (MNG-7980) Add ability to ignore transitive dependency repositories

2024-01-26 Thread Herve Boutemy (Jira)


 [ 
https://issues.apache.org/jira/browse/MNG-7980?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Herve Boutemy updated MNG-7980:
---
Description: 
In certain cases it is valid to ignore repositories introduced by transitive 
dependencies. They are usually needed, but in certain cases (ie. air gapped 
environment) they are just causing problems. Even if environment, or the POM 
itself defines all the repositories needed for the build (so the "superset" of 
remote repositories that have all the artifacts the build even needs), this 
requires tuning in case of dependency changes, as new and new repositories may 
be introduced as dependencies change.
Ideally, Maven could be instructed to globally ignore any repository introduced 
by dependency, as POM itself has it call (in controlled fashion) to fulfil all 
the artifacts.

=> add CLI option to {{mvn}} command: {{-itr}}, 
{{ignore-transitive-repositories}} 
https://maven.apache.org/ref/4.0.0-alpha-12/maven-embedder/cli.html

  was:
In certain cases it is valid to ignore repositories introduced by transitive 
dependencies. They are usually needed, but in certain cases (ie. air gapped 
environment) they are just causing problems. Even if environment, or the POM 
itself defines all the repositories needed for the build (so the "superset" of 
remote repositories that have all the artifacts the build even needs), this 
requires tuning in case of dependency changes, as new and new repositories may 
be introduced as dependencies change.
Ideally, Maven could be instructed to globally ignore any repository introduced 
by dependency, as POM itself has it call (in controlled fashion) to fulfil all 
the artifacts.

=> add CLI option to {{mvn}} command: {{-itr}}, 
{{ignore-transitive-repositories}}


> Add ability to ignore transitive dependency repositories
> 
>
> Key: MNG-7980
> URL: https://issues.apache.org/jira/browse/MNG-7980
> Project: Maven
>  Issue Type: Improvement
>  Components: Core
>Reporter: Tamas Cservenak
>Assignee: Tamas Cservenak
>Priority: Major
> Fix For: 4.0.0, 4.0.0-alpha-12
>
>
> In certain cases it is valid to ignore repositories introduced by transitive 
> dependencies. They are usually needed, but in certain cases (ie. air gapped 
> environment) they are just causing problems. Even if environment, or the POM 
> itself defines all the repositories needed for the build (so the "superset" 
> of remote repositories that have all the artifacts the build even needs), 
> this requires tuning in case of dependency changes, as new and new 
> repositories may be introduced as dependencies change.
> Ideally, Maven could be instructed to globally ignore any repository 
> introduced by dependency, as POM itself has it call (in controlled fashion) 
> to fulfil all the artifacts.
> => add CLI option to {{mvn}} command: {{-itr}}, 
> {{ignore-transitive-repositories}} 
> https://maven.apache.org/ref/4.0.0-alpha-12/maven-embedder/cli.html



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


[jira] [Updated] (MNG-7980) Add ability to ignore transitive dependency repositories

2024-01-26 Thread Herve Boutemy (Jira)


 [ 
https://issues.apache.org/jira/browse/MNG-7980?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Herve Boutemy updated MNG-7980:
---
Description: 
In certain cases it is valid to ignore repositories introduced by transitive 
dependencies. They are usually needed, but in certain cases (ie. air gapped 
environment) they are just causing problems. Even if environment, or the POM 
itself defines all the repositories needed for the build (so the "superset" of 
remote repositories that have all the artifacts the build even needs), this 
requires tuning in case of dependency changes, as new and new repositories may 
be introduced as dependencies change.
Ideally, Maven could be instructed to globally ignore any repository introduced 
by dependency, as POM itself has it call (in controlled fashion) to fulfil all 
the artifacts.

=> add CLI option to {{mvn}} command: {{-itr}}, 
{{ignore-transitive-repositories}}

  was:
In certain cases it is valid to ignore repositories introduced by transitive 
dependencies. They are usually needed, but in certain cases (ie. air gapped 
environment) they are just causing problems. Even if environment, or the POM 
itself defines all the repositories needed for the build (so the "superset" of 
remote repositories that have all the artifacts the build even needs), this 
requires tuning in case of dependency changes, as new and new repositories may 
be introduced as dependencies change.
Ideally, Maven could be instructed to globally ignore any repository introduced 
by dependency, as POM itself has it call (in controlled fashion) to fulfil all 
the artifacts.


> Add ability to ignore transitive dependency repositories
> 
>
> Key: MNG-7980
> URL: https://issues.apache.org/jira/browse/MNG-7980
> Project: Maven
>  Issue Type: Improvement
>  Components: Core
>Reporter: Tamas Cservenak
>Assignee: Tamas Cservenak
>Priority: Major
> Fix For: 4.0.0, 4.0.0-alpha-12
>
>
> In certain cases it is valid to ignore repositories introduced by transitive 
> dependencies. They are usually needed, but in certain cases (ie. air gapped 
> environment) they are just causing problems. Even if environment, or the POM 
> itself defines all the repositories needed for the build (so the "superset" 
> of remote repositories that have all the artifacts the build even needs), 
> this requires tuning in case of dependency changes, as new and new 
> repositories may be introduced as dependencies change.
> Ideally, Maven could be instructed to globally ignore any repository 
> introduced by dependency, as POM itself has it call (in controlled fashion) 
> to fulfil all the artifacts.
> => add CLI option to {{mvn}} command: {{-itr}}, 
> {{ignore-transitive-repositories}}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] Improve wording on artifact:compare introducing false positives [maven-site]

2024-01-26 Thread via GitHub


yurloc commented on code in PR #489:
URL: https://github.com/apache/maven-site/pull/489#discussion_r1467552884


##
content/apt/guides/mini/guide-reproducible-builds.apt:
##
@@ -78,7 +78,10 @@ mvn clean verify artifact:compare
 
  []
 
- Notice that this does NOT really prove that your build is yet reproducible, 
because your build may still suffer from environment leaks (username, current 
directory, ...). But it is easy to do, and prevents basic non-reproducible 
issues like timestamps.
+ Notice that this does NOT really prove that your build is yet reproducible, 
because your build may still suffer from environment leaks (username, current 
directory, ...). 
+ Also not that it might suffer from false positives. Libraries included in 
your build might not support reproducible builds themselves but at the same 
time produce reproducible artifacts.

Review Comment:
   If that is true and we could remove it then the false-positive failure of 
`artifact:check-buildplan` would disappear and so would the confusion and this 
paragraph wouldn't need any update.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Created] (MNG-8028) Maven3 "resolves" in-reactor dependency if there is main artifact present

2024-01-26 Thread Tamas Cservenak (Jira)
Tamas Cservenak created MNG-8028:


 Summary: Maven3 "resolves" in-reactor dependency if there is main 
artifact present
 Key: MNG-8028
 URL: https://issues.apache.org/jira/browse/MNG-8028
 Project: Maven
  Issue Type: Bug
  Components: Core
Reporter: Tamas Cservenak
 Fix For: 4.0.0, 4.0.0-alpha-13


Which, is IMHO wrong. As if main artifact file is absent, it will try to 
download the reactor module from remote repository.

A reactor module is "done" when all the lifecycles was executed on it. Maven 
should not imply anything about presence or absence of main artifact, as the 
build may not even build one (think "go offline" use cases or new skip 
capabilities).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)


Re: [PR] Improve wording on artifact:compare introducing false positives [maven-site]

2024-01-26 Thread via GitHub


yurloc commented on code in PR #489:
URL: https://github.com/apache/maven-site/pull/489#discussion_r146755


##
content/apt/guides/mini/guide-reproducible-builds.apt:
##
@@ -78,7 +78,10 @@ mvn clean verify artifact:compare
 
  []
 
- Notice that this does NOT really prove that your build is yet reproducible, 
because your build may still suffer from environment leaks (username, current 
directory, ...). But it is easy to do, and prevents basic non-reproducible 
issues like timestamps.
+ Notice that this does NOT really prove that your build is yet reproducible, 
because your build may still suffer from environment leaks (username, current 
directory, ...). 
+ Also not that it might suffer from false positives. Libraries included in 
your build might not support reproducible builds themselves but at the same 
time produce reproducible artifacts.

Review Comment:
   In my opinion, this is inaccurate and adds more confusion than it removes. 
The false positive check result we've seen in OptaPlanner didn't come from the 
`artifact:compare` check that this paragraph is about but from 
`artifact:check-buildplan` which is mentioned in the next section.
   
   @hboutemy I'd like to check with you first, before we try to polish this up 
and go into perhaps unnecessary details about false positives and the 
optionality of some checks... Do you think we could remove the jaxb2 plugin 
from the [issue 
list](https://github.com/apache/maven-artifact-plugin/blob/c0ab5135f9208b72e58a7b89bba48593a31674f1/src/site/apt/plugin-issues.apt#L73)
 since it turned out that using that plugin doesn't make the project build 
non-reproducible (only the plugin's build is not reproducible)?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



Re: [PR] Improve wording on artifact:compare introducing false positives [maven-site]

2024-01-26 Thread via GitHub


yurloc commented on code in PR #489:
URL: https://github.com/apache/maven-site/pull/489#discussion_r146755


##
content/apt/guides/mini/guide-reproducible-builds.apt:
##
@@ -78,7 +78,10 @@ mvn clean verify artifact:compare
 
  []
 
- Notice that this does NOT really prove that your build is yet reproducible, 
because your build may still suffer from environment leaks (username, current 
directory, ...). But it is easy to do, and prevents basic non-reproducible 
issues like timestamps.
+ Notice that this does NOT really prove that your build is yet reproducible, 
because your build may still suffer from environment leaks (username, current 
directory, ...). 
+ Also not that it might suffer from false positives. Libraries included in 
your build might not support reproducible builds themselves but at the same 
time produce reproducible artifacts.

Review Comment:
   In my opinion, this is inaccurate and adds more confusion than it removes. 
The false positive check result we've seen in OptaPlanner didn't come from the 
`artifact:compare` check that this paragraph is about but from 
`artifact:check-buildplan`, which is mentioned in the next section.
   
   @hboutemy I'd like to check with you first, before we try to polish this up 
and go into perhaps unnecessary details about false positives and the 
optionality of some checks... Do you think we could remove the jaxb2 plugin 
from the [issue 
list](https://github.com/apache/maven-artifact-plugin/blob/c0ab5135f9208b72e58a7b89bba48593a31674f1/src/site/apt/plugin-issues.apt#L73)
 since it turned out that using that plugin doesn't make the project build 
non-reproducible (only the plugin's build is not reproducible)?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org



[jira] [Created] (MRESOLVER-482) Seems config "aether.syncContext.named.retry" has no effect

2024-01-26 Thread Tamas Cservenak (Jira)
Tamas Cservenak created MRESOLVER-482:
-

 Summary: Seems config "aether.syncContext.named.retry" has no 
effect
 Key: MRESOLVER-482
 URL: https://issues.apache.org/jira/browse/MRESOLVER-482
 Project: Maven Resolver
  Issue Type: Bug
  Components: Resolver
Affects Versions: 1.9.18
Reporter: Tamas Cservenak
 Fix For: 2.0.0, 1.9.19, 2.0.0-alpha-8






--
This message was sent by Atlassian Jira
(v8.20.10#820010)