ascheman commented on issue #11856: URL: https://github.com/apache/maven/issues/11856#issuecomment-5010731869
Reopening with new evidence: this failure mode has a large public instance, and the changes merged for this issue improve diagnostics but not the outcome. **Data point.** `https://repo.jenkins-ci.org/public/.meta/prefixes.txt` (Artifactory virtual repo) serves a leaked member-repo prefixes file: correct magic header, "Generated by Sonatype Nexus", `Last-Modified: 12 Jan 2017`, 11 SVNKit-era prefixes — no `/org/jenkins-ci`, no `/io/jenkins`. With default RRF essentially every Jenkins-ecosystem build fails on 4.0.0-rc-5, current 4.0.x-SNAPSHOT **and 3.10.0-rc-1** (`Prefix org/jenkins-ci/... NOT allowed from repo.jenkins-ci.org`), while 3.9.x works. On 3.10.0-rc-1 it is worse: the denial surfaces only as a *suppressed* exception, so the visible error is the misleading "Could not find artifact ... in central" (#11888 landed on master and 4.0.x only). Repro: `mvn dependency:get -Dartifact=org.jenkins-ci:version-number:1.14`. We reported the broken file to jenkins-infra (jenkins-infra/helpdesk#5231), but ordinary users control neither the MRM nor — until rc-6's improved message ships — get any hint about the workaround. **Why reopen.** What was merged for this issue — #11888/#12234 (better error message, lands in rc-6) and apache/maven-resolver#1820 (docs) — makes the failure explainable, but the default behavior still hard-disables an entire repository based on one provably wrong file. Given a repository of this visibility ships such a file, this seems worth solving before the Maven 4 GA and the imminent 3.10.0 GA (both ship Resolver 2.x defaults) rather than per-user. **Proposed fix.** apache/maven-resolver#1976 implements a bounded self-heal: the first denied path per repository from an *auto-discovered* prefixes file is verified against the repository itself (one `peek`); if the path exists, the file is provably wrong and is dropped for the session with a warning. User-provided files stay authoritative; opt-out via `-Daether.remoteRepositoryFilter.prefixes.verifyDenied=false`. Cost for healthy repositories: at most one extra request per repository per session. I am also adding this to the 4.0.0-rc-6 milestone for visibility. The concrete ask for rc-6 is: either pick up a resolver release containing the self-heal, or at minimum ship a release-notes callout for the documented workaround. Feel free to re-triage (milestone and state) if you prefer tracking this on the resolver side — reopening mainly so the Jenkins-scale impact is visible on the original report. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
