[MNG-8076] when jar in local repository from other repository id, should not reject but check if it is also available in current repository id context

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.9.6
• Assignee: Unassigned
• Reporter: Herve Boutemy
• Created: 16/Mar/24 08:15
• Updated: 03/May/24 20:55

Description

precise context: Reproducible Central https://github.com/jvm-repo-rebuild/reproducible-central
in the past, I rebuilt maven-shade-plugin 3.5.2 during the vote, which downloaded the reference jar in a staging remote repository with "reference" id (that's part of the artifact:compare logic in Apache staging: see https://github.com/jvm-repo-rebuild/reproducible-central/issues/140 for details on this recent Reproducible Central feature)

When I'm trying to rebuild a project that uses this maven-shade-plugin 3.5.2 release, I get:

[INFO] Artifact org.apache.maven.plugins:maven-shade-plugin:pom:3.5.2 is present in the local repository, but cached from a remote repository ID that is unavailable in current build context, verifying that is downloadable from [central (https://repo.maven.apache.org/maven2, default, releases)]

looking in the local repository, I get

cat ~/.m2/repository/org/apache/maven/plugins/maven-shade-plugin/3.5.2/_remote.repositories
#NOTE: This is a Maven Resolver internal implementation file, its format can be changed without prior notice.
#Sun Feb 18 15:03:27 UTC 2024
maven-shade-plugin-3.5.2-sources.jar>reference=
maven-shade-plugin-3.5.2.pom>reference=
maven-shade-plugin-3.5.2.jar>reference=
maven-shade-plugin-3.5.2-source-release.zip>reference=
maven-shade-plugin-3.5.2-cyclonedx.xml>reference=
maven-shade-plugin-3.5.2-cyclonedx.json>reference=

the fact that all these artifacts were initially downloaded through "reference" repository id does not mean that they are not also available with the "central" id

as a precise workaround, i did not delete the _remote.repositories file but replaced reference with central and it works as expected. The opposite update can restore the failing behaviour...

for now, I know that by rebuilding releases from Apache staging area, I'm polluting my local repository :/

Issue Links

• is related to: MRESOLVER-555 Existence check should lax the repository update policy
• relates to: MNG-5185 Improve "missing dependency" error message when _maven.repositories/_remote.repositories contains other repository ids than requested
• relates to: MRESOLVER-333 Distinguish better resolver errors for artifact availability