[MNG-5781] resolution of nested import scoped dependencies causes maven to reach out to external central repo

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.2.5
• Fix Version/s: 4.0.x-candidate
• Component/s: Bootstrap & Build, Dependencies
• Labels: must-be-in-4.0.0-alpha-2

Environment

Apache Maven 3.2.5 (12a6b3acb947671f09b81f49094c53f426d8cea1; 2014-12-14T09:29:23-08:00)
Maven home: /usr/local/maven-3.2.5
Java version: 1.7.0_76, vendor: Oracle Corporation
Java home: /usr/local/jdk1.7.0_76-server-jre/jre
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "2.6.32-504.3.3.el6.centos.plus.x86_64", arch: "amd64", family: "unix"

• Assignee: Unassigned
• Reporter: Ravi Sanwal
• Created: 06/Mar/15 18:21
• Updated: 02/Mar/22 20:17

Description

When a project uses a dependency that has as import scoped dependency, which in turn also has another import scoped dependency (nested imported scoped dependencies), resolution of the last level of dependency makes maven to reach our to the external central repository (https://repo.maven.apache.org/maven2/)

Steps to reproduce:
Use the attached global settings file.
It has an internal repository declared as a replacement to 'central', you can point to one of your own internal repo.(not the local)

Build the attached file first.pom.xml: 

mvn -gs global_settings.xml install -f first.pom.xml

Build the attached file second.pom.xml:

mvn install -f second.pom.xml

Then, delete org.aspectj:aspectjtools from local repo (rm ~/.m2/repository/org/aspectj/aspectjtools), we want to download this from our internal central repository alias repository.
Build the attached file last.pom.xml: 

mvn -gs global_settings.xml dependency:copy-dependencies -f last.pom.xml

(copy dependencies because this is a pom project, alternatively change last.pom.xml to a jar project and do mvn -gs global_settings.xml install - same thing)

You'll see that org.aspectj:aspectjtools is being downloaded from central (https://repo.maven.apache.org/maven2/) effectively rendering hosting our own repositories useless.

Issue Links

• is duplicated by: MNG-6772 Super POM overwrites remapped central repository in nested dependencyManagement import POMs