CycloneDX / CycloneDX/cyclonedx-maven-plugin

Multi-module projects slow to build due to makeAggregateBom trying to download reactor modules from repo

Open
#138 3 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
385
Forks
108
Avg merge
17h 31m
Merged PRs (30d)
7

Description

The makeAggregateBom goal causes Maven to attempt to fetch some reactor modules from the repo instead of from the local project files. This occurs when one project module depends on another and thus that second one is listed as a dependency. At best you see warning messages like this:

[WARNING] The following dependencies could not be resolved at this point of the build but seem to be part of the reactor:
[WARNING] o org.example:cyclonedx-test-service:jar:1.0-SNAPSHOT (compile)
[WARNING] o org.example:cyclonedx-test-common:jar:1.0-SNAPSHOT (compile)
[WARNING] Try running the build up to the lifecycle phase "package"

At worst, if your project is setup to fetch snapshot dependencies, it leads to Maven trying to download each module from its configured repository, and waiting for a time out before continuing. In my organisation using Artifactory this adds 15sec to 30sec for each module it tries to download (I think Artifactory has a 15sec timeout on failing to find an artifact):

Downloading from maven-digital-virtual: https://artifactory.my-company.com/artifactory/org/example/cyclonedx-test-common/1.0-SNAPSHOT/maven-metadata.xml
{..wait 15sec for timeout..}
Downloading from maven-digital-virtual: https://artifactory.my-company.com/artifactory/org/example/cyclonedx-test-common/1.0-SNAPSHOT/cyclonedx-test-common-1.0-SNAPSHOT.jar
{..wait 15sec for timeout..}
[WARNING] The following dependencies could not be resolved at this point of the build but seem to be part of the reactor:
[WARNING] o org.example:cyclonedx-test-common:jar:1.0-SNAPSHOT (compile)
[WARNING] Try running the build up to the lifecycle phase "package"
Downloading from maven-digital-virtual: https://artifactory.my-company.com/artifactory/org/example/cyclonedx-test-service/1.0-SNAPSHOT/maven-metadata.xml
{..wait 15sec for timeout..}
Downloading from maven-digital-virtual: https://artifactory.my-company.com/artifactory/org/example/cyclonedx-test-service/1.0-SNAPSHOT/cyclonedx-test-service-1.0-SNAPSHOT.jar
{..wait 15sec for timeout..}
[WARNING] The following dependencies could not be resolved at this point of the build but seem to be part of the reactor:
[WARNING] o org.example:cyclonedx-test-service:jar:1.0-SNAPSHOT (compile)
[WARNING] o org.example:cyclonedx-test-common:jar:1.0-SNAPSHOT (compile)
[WARNING] Try running the build up to the lifecycle phase "package"

This is also mentioned in issue #85, which only talks about the warning message.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the makeAggregateBom goal and reproduce the issue in a multi-module Maven project where one reactor module depends on another. Trace dependency resolution and verify that reactor modules are taken from the local project rather than queried from configured repositories; done means the repository download delays and warnings no longer occur.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.