cstamas commented on issue #13732: URL: https://github.com/apache/maven/issues/13732#issuecomment-6480655092
So, this is interesting problem. As I see, we face multiple issues here. For start, the CLI `-itr` option (as can be seen in related changes https://github.com/apache/maven/pull/1469) is _used by Resolver only, only during collection_. The problem stems from m-assembly-p, and no Resolver collection is involved at all. Here is the problem: https://github.com/apache/maven-assembly-plugin/blob/8ab476175f9343498394b1b871d355e043cefb9f/src/main/java/org/apache/maven/plugins/assembly/archive/task/AddDependencySetsTask.java#L151 It uses Maven ProjectBuilder to build `MavenProject` for each dependency (!). Maven's project build treat (the dependency POM) as "current project", and obeys whatever stands in it, even repository definitions. Finally, the dependency _is resolved_ using project repositories, and, as you noted, one dependency does define `jvnet-nexus-releases` repository. So, the artifact is being _resolved_ with ProjectBuilder found repositories (this is how `jvnet-nexus-releases` comes into play), and RRF immediately kicks in, as "there is new repository seen", as at that moment, Resolver does not knows, does it or will it be used (will not, all is in Central). OTOH1, just today on Slack someone brought up dependency handling in use cases like "as project" and "as dependency" (is declared as dependency). And in this case, we clearly violate this, as we use `ProjectBuilder` to build `MavenProject` "as project" _of a dependency_, only to later resolve it (again, there is no collection happening at all). To me, this looks wrong. In fact, build "as project" the dependency POM to me looks very heavy handed, as if you look _why_ we need `MavenProject` down the road (only to get some interpolators), all of this looks a bit weird to me. OTOH1, this is why MIMA MMR extension exists, to be able to get "effective models" of dependencies (the "as dependency" use case), as explained in README: https://github.com/maveniverse/mima/tree/main/extensions/mmr -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
