[MARTIFACT-76] with Maven 4, remote consumer pom is downloaded with "consumer" classifier

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 3.5.2
• Fix Version/s: 3.5.3
• Component/s: artifact:compare
• Labels: pull-request-available
• Assignee: Herve Boutemy
• Reporter: Herve Boutemy
• Created: 27/Oct/24 09:52
• Updated: 27/Oct/24 16:21
• Resolved: 27/Oct/24 16:14

Description

[INFO] --- artifact:3.5.2:compare (default-cli) @ maven-dependency-analyzer ---
[INFO] Saved info on build to /var/maven/app/target/maven-dependency-analyzer-1.15.1.buildinfo
[INFO] Checking against reference build from central...
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1.buildinfo
[INFO] Reference buildinfo file not found: it will be generated from downloaded reference artifacts
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1.pom (32 kB at 1.2 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1.jar
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1.jar (45 kB at 3.0 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1-consumer.pom
[WARNING] Reference artifact not found org.apache.maven.shared:maven-dependency-analyzer:pom:consumer:1.15.1
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1-source-release.zip
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1-source-release.zip (210 kB at 8.1 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1-sources.jar
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1-sources.jar (41 kB at 1.9 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1-cyclonedx.xml
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1-cyclonedx.xml (86 kB at 3.2 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1-cyclonedx.json
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1-cyclonedx.json (99 kB at 3.7 MB/s)
[INFO] Reference build java.version: 21 (from MANIFEST.MF Build-Jdk-Spec)
[INFO] Reference build os.name: Unix (from pom.properties newline)
[INFO] Minimal buildinfo generated from downloaded artifacts: /var/maven/app/target/reference/maven-dependency-analyzer-1.15.1.buildinfo
[ERROR] size mismatch maven-dependency-analyzer-1.15.1-consumer.pom: investigate with diffoscope target/reference/org.apache.maven.shared/maven-dependency-analyzer-1.15.1-consumer.pom target/consumer-14611872023272649464.pom
[ERROR] Reproducible Build output summary: 7 files ok, 1 different

instead of

Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1-consumer.pom
[WARNING] Reference artifact not found org.apache.maven.shared:maven-dependency-analyzer:pom:consumer:1.15.1

it should be

Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-dependency-analyzer/1.15.1/maven-dependency-analyzer-1.15.1.pom

without any warning for reference artifact org.apache.maven.shared:maven-dependency-analyzer:pom:1.15.1

Issue Links

• is caused by: MARTIFACT-67 build pom *-build.pom not checked when run with Maven 4
• links to: GitHub Pull Request #68