[MNG-6283] [regression] resolution of nested import-scoped transitive dependencies ignores repositories overwriting 'central'

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.2.2, 3.5.0, 3.6.3
• Component/s: Artifacts and Repositories, Dependencies
• Assignee: Unassigned
• Reporter: Stefan Dellmuth
• Created: 12/Sep/17 13:01
• Updated: 13/Apr/21 17:24

Description

We have one occurrence of a "nested BOM", i.e. an import-scoped dependency which is transitively resolved as part of another import-scoped dependency. Moreover, as we are behind a company proxy, our only way of downloading dependencies is via our own repository in our Maven settings called central which is overwriting the default Maven Central repository.

Maven 3.2.2 introduced a regression which breaks the resolution of such nested BOM dependencies. Maven tries to resolve them against the Maven Central repository instead of our own.

So:

<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>de.msg.maven</groupId>
    <artifactId>nested-import-scope-example</artifactId>
    <version>1.0</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>de.msg.maven</groupId>
                <artifactId>nested-import-scope-bom</artifactId>
                <version>1.0</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
</project>

...which in turn leads to...

<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>de.msg.maven</groupId>
    <artifactId>nested-import-scope-bom</artifactId>
    <version>1.0</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.jboss.bom.wfk</groupId>
                <artifactId>jboss-javaee-6.0-with-tools</artifactId>
                <version>2.4.0-redhat-2</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

</project>

Maven settings contain:

<profiles>
    <profile>
   	<repositories>
            <repository>
            	<id>central</id>
           	<url>http://maven.repository.redhat.com/techpreview/all/</url>
            </repository>
    	</repositories>
	<id>jboss</id>
    </profile>
</profiles>
<activeProfiles>
    <activeProfile>jboss</activeProfile>
</activeProfiles>

...yields...

[INFO] Scanning for projects...
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[ERROR] Non-resolvable import POM: Failure to find org.jboss.spec:jboss-javaee-6.0:pom:3.0.2.Final-redhat-4 in https://repo.maven.apache.org/maven2 was cached in the local repository, resolution will not be reattempted until the update interval of central has elapsed or updates are forced @ org.jboss.bom.wfk:jboss-javaee-6.0-with-tools:[unknown-version], C:\Users\zzz\.m2\repository\org\jboss\bom\wfk\jboss-javaee-6.0-with-tools\2.4.0-redhat-2\jboss-javaee-6.0-with-tools-2.4.0-redhat-2.pom, line 42, column 25
 @ 
[ERROR] The build could not read 1 project -> [Help 1]
[ERROR]   
[ERROR]   The project de.msg.maven:nested-import-scope:1.0 (C:\Users\zzz\Projekte\GitHub\nestedimportscope\pom.xml) has 1 error
[ERROR]     Non-resolvable import POM: Failure to find org.jboss.spec:jboss-javaee-6.0:pom:3.0.2.Final-redhat-4 in https://repo.maven.apache.org/maven2 was cached in the local repository, resolution will not be reattempted until the update interval of central has elapsed or updates are forced @ org.jboss.bom.wfk:jboss-javaee-6.0-with-tools:[unknown-version], C:\Users\zzz\.m2\repository\org\jboss\bom\wfk\jboss-javaee-6.0-with-tools\2.4.0-redhat-2\jboss-javaee-6.0-with-tools-2.4.0-redhat-2.pom, line 42, column 25 -> [Help 2]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException
[ERROR] [Help 2] http://cwiki.apache.org/confluence/display/MAVEN/UnresolvableModelException

Process finished with exit code 1

...if I want to resolve the dependencies of nested-import-scope-example (while having nested-import-scope-bom available in my local or company's repository) fails because Maven tries to download the JBoss BOM from Maven Central.

Workaround: Renaming our company repository's ID to something other than central works as expected.

Disclaimer:
As I can't use our company repository's address here, I've reproduced the problem with the example of MNG-5663 which I've found during my research.

Issue Links

• duplicates: MNG-6772 Super POM overwrites remapped central repository in nested dependencyManagement import POMs