[MNG-4418] Dependency resolution appears to misbehave if a remote repository uses the id "local"

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.2.1
• Fix Version/s: 3.0-beta-1
• Component/s: Artifacts and Repositories
• Assignee: Benjamin Bentmann
• Reporter: Benjamin Bentmann
• Created: 30/Oct/09 09:28
• Updated: 09/Nov/10 05:20
• Resolved: 30/Mar/10 17:53

Description

Consider something like

<mirror>
  <id>local</id>
  <mirrorOf>*</mirrorOf>
  <url>http://localhost/mymirror</url>
</mirror>

in the settings. Note in particular that the mirror uses the id "local". This severely impacts dependency resolution as this repo id is internally used for the local repository. In particular the path to the locally stored repo metadata uses this id, i.e. maven-metadata-local.xml, making it impossible for Maven to distinguish the real local repo metadata from the remote repo called "local".

Possible error scenario:

• user installs local snapshot of a artifact A
• Maven checks remote repo "local" for updates of A, thereby overwriting maven-metadata-local.xml and erasing the information about the local snapshot
• Maven downloads snapshot version of A from the remote repo, regardless of its age compared to the locally installed snapshot

Issue Links

• relates to: MNG-4891 Improve robustness of snapshot dependency resolution in case a remote repo accidently uses the id "local"
• relates to: MNG-4658 Relax validation of repository ids and only warn upon conflict with "local"