[MNG-2098] Artifact resolver incorrectly selects repository which doesn't contain the selected version

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.2
• Fix Version/s: 3.0-alpha-3
• Component/s: Artifacts and Repositories
• Assignee: Benjamin Bentmann
• Reporter: Garrett Conaty
• Created: 21/Feb/06 14:24
• Updated: 23/Oct/09 05:03
• Resolved: 25/Sep/09 07:15

Description

The current logic for resolution of an artifact which has groupId/artifactId and then a range is for the DefaultArtifactCollector to call MavenMetadataSource and retrieve the available versions and then match the available versions to the range.

However, a side effect exists in that the DefaultRepositoryMetadataManager in its call to mergeMetadata sets the repository for the artifact. It currently just sets it to the last repository that had versions to merge. What occurs here though is that it can be set to a repository that doesn't actually have the artifact that is selected as part of the match of version range to available versions. Then when this artifact is passed to the resolver to download the JAR it references, it of course can't find it and an exception is thrown.

So there are a couple of issues here
1) Should the DefaultArtifactResolver really use artifact.getRepository() exclusively if it's not null? Perhaps the Artifact really ought to contain a list of repositories that are acceptable (from the transformation phase) from which to try. This may be a good enhancment.

but the more pressing issue is
2) Shouldn't the DefaultArtifactCollector actually do the repository selection, not have it be a side effect of getting the metadata.

The simple patch I've attached solves the problem by just removing the call to setRepository in the mergeMetadata method. This has the effect that there will be no repository chosen by the time the DefaultArtifactResolver gets a hold of the artifact and it will then go through the list of remoteRepositories until it finds a succesful match.

What I'd like to do though is really modify the DefaultArtifactCollector and MavenMetadataSource so that the collector can make the decision about what repository/list of repositories to use, and in the very least choose the repository that has the version that was matched in the range.

Issue Links

• is duplicated by: MNG-4380 Failure to resolve artifact if there is a dependency that uses version range
• relates to: MNG-2438 search for metadata in legacy repositories causes wrong repository source to be used for artifact resolution
• relates to: MNG-1974 Improve repository searching for artifacts