CycloneDX / CycloneDX/cyclonedx-maven-plugin
Multi-module projects slow to build due to makeAggregateBom trying to download reactor modules from repo
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 385
- Forks
- 108
- Avg merge
- 17h 31m
- Merged PRs (30d)
- 7
Description
The makeAggregateBom goal causes Maven to attempt to fetch some reactor modules from the repo instead of from the local project files. This occurs when one project module depends on another and thus that second one is listed as a dependency. At best you see warning messages like this:
[WARNING] The following dependencies could not be resolved at this point of the build but seem to be part of the reactor:
[WARNING] o org.example:cyclonedx-test-service:jar:1.0-SNAPSHOT (compile)
[WARNING] o org.example:cyclonedx-test-common:jar:1.0-SNAPSHOT (compile)
[WARNING] Try running the build up to the lifecycle phase "package"
At worst, if your project is setup to fetch snapshot dependencies, it leads to Maven trying to download each module from its configured repository, and waiting for a time out before continuing. In my organisation using Artifactory this adds 15sec to 30sec for each module it tries to download (I think Artifactory has a 15sec timeout on failing to find an artifact):
Downloading from maven-digital-virtual: https://artifactory.my-company.com/artifactory/org/example/cyclonedx-test-common/1.0-SNAPSHOT/maven-metadata.xml
{..wait 15sec for timeout..}
Downloading from maven-digital-virtual: https://artifactory.my-company.com/artifactory/org/example/cyclonedx-test-common/1.0-SNAPSHOT/cyclonedx-test-common-1.0-SNAPSHOT.jar
{..wait 15sec for timeout..}
[WARNING] The following dependencies could not be resolved at this point of the build but seem to be part of the reactor:
[WARNING] o org.example:cyclonedx-test-common:jar:1.0-SNAPSHOT (compile)
[WARNING] Try running the build up to the lifecycle phase "package"
Downloading from maven-digital-virtual: https://artifactory.my-company.com/artifactory/org/example/cyclonedx-test-service/1.0-SNAPSHOT/maven-metadata.xml
{..wait 15sec for timeout..}
Downloading from maven-digital-virtual: https://artifactory.my-company.com/artifactory/org/example/cyclonedx-test-service/1.0-SNAPSHOT/cyclonedx-test-service-1.0-SNAPSHOT.jar
{..wait 15sec for timeout..}
[WARNING] The following dependencies could not be resolved at this point of the build but seem to be part of the reactor:
[WARNING] o org.example:cyclonedx-test-service:jar:1.0-SNAPSHOT (compile)
[WARNING] o org.example:cyclonedx-test-common:jar:1.0-SNAPSHOT (compile)
[WARNING] Try running the build up to the lifecycle phase "package"
This is also mentioned in issue #85, which only talks about the warning message.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the makeAggregateBom goal and reproduce the issue in a multi-module Maven project where one reactor module depends on another. Trace dependency resolution and verify that reactor modules are taken from the local project rather than queried from configured repositories; done means the repository download delays and warnings no longer occur.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100