[MRESOLVER-277] --no-snapshot-update option does not prevent metadata.xml download

[jira-importer]

Réda Housni Alaoui opened MRESOLVER-277 and commented

I have a multi-module project.

Each time I build the project using an empty local repository, maven-resolver tries to download the metadata.xml of each module even if I pass --no-snapshot-update option.

I think it is a bug.

---

Issue Links:

• MENFORCER-435 Get rid of maven-dependency-tree dependency
  ("depends upon")

[jira-importer]

Michael Osipov commented

But with an empy repo what do you expect?

[jira-importer]

Réda Housni Alaoui commented

The fetched metadata are the ones of the built modules. i.e. If I have a module A and another one B, mvn clean package -nsu will try to fetch metadata.xml of artifact A and metadata.xml of artifact B.

Why would Maven go fetch them on a remote repository with -nsu enabled ?

[jira-importer]

Réda Housni Alaoui commented

From a rapid debugging, IMHO, when check.getPolicy() returns NEVER at

maven-resolver/maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/DefaultUpdateCheckManager.java

Line 232 in 11db4e3

if ( check.getLocalLastUpdated() != 0

,  we should call check.setRequired(false).

Copy-paste of the related code:

public void checkMetadata( RepositorySystemSession session, UpdateCheck<Metadata, MetadataTransferException> check )
    {
        if ( check.getLocalLastUpdated() != 0
            && !isUpdatedRequired( session, check.getLocalLastUpdated(), check.getPolicy() ) )
        {
            LOGGER.debug( "Skipped remote request for {} locally installed metadata up-to-date", check.getItem() );

            check.setRequired( false );
            return;
        }

        Metadata metadata = check.getItem();
        RemoteRepository repository = check.getRepository();

        File metadataFile = requireNonNull( check.getFile(), String.format( "The metadata '%s' has no file attached",
                metadata ) );

        boolean fileExists = check.isFileValid() && metadataFile.exists();

[jira-importer]

Michael Osipov commented

Tamas Cservenak, WDYT?

[jira-importer]

Tamas Cservenak commented

IMHO, this works as intented. This is the definition of "never" policy:

/**
 * Never update locally cached data.
 */
public static final String UPDATE_POLICY_NEVER = "never"; 

Key part: "never update locally cached data". With empty repository, you have no locally cached data.

Réda Housni Alaoui you probably mean "offline for metadata"? As such a feature would prevent download, but is not supported.

[jira-importer]

Réda Housni Alaoui commented

Key part: "never update locally cached data". With empty repository, you have no locally cached data.

Indeed, therefore it is not a bug.

Réda Housni Alaoui you probably mean "offline for metadata"? As such a feature would prevent download, but is not supported.

Yes. Would you accept this as a new feature? I can contribute with code if needed.

[jira-importer]

Tamas Cservenak commented

Before doing a patch, am more interested in the problem, What do you mean by "each time I build the project using an empty local repository, maven-resolver tries to download the metadata.xml of each module". You mean the module you are building? Can you create a small reproducer for this?

[jira-importer]

Réda Housni Alaoui commented

Tamas Cservenak I made a reproducer at => https://github.com/reda-alaoui/mresolver-277/

The issue is triggered by the following conditions:

• maven-enforcer-plugin with requireUpperBoundDeps rule enabled
• at least one custom snapshots repository declared
• no negative cache entry for the project modules in the local repository

The command to run would be like:

rm -fr ~/.m2/repository/me/redaalaoui/mresolver_277 && mvn clean package

You will see these lines in the log:

[INFO] ------------------< me.redaalaoui.mresolver_277:core >------------------
[INFO] Building core 1-SNAPSHOT                                           [2/3]
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- maven-clean-plugin:2.5:clean (default-clean) @ core ---
[INFO] Deleting /home/rhousni/projects/mresolver-277/core/target
[INFO] 
[INFO] --- maven-enforcer-plugin:3.0.0:enforce (enforce) @ core ---
Downloading from spring-snapshot: https://repo.spring.io/snapshot/me/redaalaoui/mresolver_277/core/1-SNAPSHOT/maven-metadata.xml

[jira-importer]

Réda Housni Alaoui commented

You mean the module you are building?

Yes

[jira-importer]

Tamas Cservenak commented

To me this smells like enforcer rule bug... Thanks for reproducer! Michael Osipov WDYT?

[jira-importer]

Réda Housni Alaoui commented

Enforcer invokes dependency which invokes resolver without any exotic parameter. This is why I raised the issue in resolver.

[jira-importer]

Michael Osipov commented

public class RequireUpperBoundDeps uses Maven Dependency Tree and not Resolver directly, that could explain the difference in behavior compared to Maven Core. Unless this can be reproduced with Core only, I'd say it is somewhere between Enforcer, Dep Tree and Resolver.

One need to replace Dep Tree with Resolver directly and then compare.