[
https://issues.apache.org/jira/browse/MNG-8076?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Herve Boutemy updated MNG-8076:
-------------------------------
Summary: when jar in local repository from other repository id, should not
reject but check if it is also available in current repository id context
(was: when jar in local repository from other ids, should not reject but check
if it is also available in current context)
> when jar in local repository from other repository id, should not reject but
> check if it is also available in current repository id context
> -------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: MNG-8076
> URL: https://issues.apache.org/jira/browse/MNG-8076
> Project: Maven
> Issue Type: Bug
> Affects Versions: 3.9.6
> Reporter: Herve Boutemy
> Priority: Major
>
> precise context: Reproducible Central
> https://github.com/jvm-repo-rebuild/reproducible-central
> in the past, I rebuilt maven-shade-plugin 3.5.2 during the vote, which
> downloaded the reference jar in a staging remote repository with "reference"
> id (that's part of the artifact:compare logic in Apache staging: see
> https://github.com/jvm-repo-rebuild/reproducible-central/issues/140 for
> details on this recent Reproducible Central feature)
> When I'm trying to rebuild a project that uses this maven-shade-plugin 3.5.2
> release, I get:
> {noformat}
> [INFO] Artifact org.apache.maven.plugins:maven-shade-plugin:pom:3.5.2 is
> present in the local repository, but cached from a remote repository ID that
> is unavailable in current build context, verifying that is downloadable from
> [central (https://repo.maven.apache.org/maven2, default, releases)]
> {noformat}
> looking in the local repository, I get
> {noformat}
> cat
> ~/.m2/repository/org/apache/maven/plugins/maven-shade-plugin/3.5.2/_remote.repositories
> #NOTE: This is a Maven Resolver internal implementation file, its format can
> be changed without prior notice.
> #Sun Feb 18 15:03:27 UTC 2024
> maven-shade-plugin-3.5.2-sources.jar>reference=
> maven-shade-plugin-3.5.2.pom>reference=
> maven-shade-plugin-3.5.2.jar>reference=
> maven-shade-plugin-3.5.2-source-release.zip>reference=
> maven-shade-plugin-3.5.2-cyclonedx.xml>reference=
> maven-shade-plugin-3.5.2-cyclonedx.json>reference=
> {noformat}
> the fact that all these artifacts were initially downloaded through
> "reference" repository id does not mean that they are not *also* available
> with the "central" id
> as a precise workaround, i did not delete the _remote.repositories file but
> replaced reference with central and it works as expected. The opposite update
> can restore the failing behaviour...
> for now, I know that by rebuilding releases from Apache staging area, I'm
> polluting my local repository :/
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
