Overrides for central repository being ignored during <scope>import</scope> resolution
- Dominant language
- Java
- Stars
- 5.3k
- Forks
- 3.1k
- Avg merge
- 20h 42m
- Merged PRs (30d)
- 297
Description
### Affected version
3.9.11
### Bug description
Initially I posted that as a question in [StackOverflow](https://stackoverflow.com/questions/79824887/maven-ignores-central-repository-overrides-when-scopeimport-scopeing-pom-int), but while I was collecting the evidence, I was more convinced that this is a bug.
Please find below a copy of my SO question, so you don't have to follow the links:
=======
I have the following Maven `settings.xml` to make Maven go to my local Maven Central mirror (this is a standard way recommended by JFrog Artifactory):
```xml
artifactory
central
mvn-libs-release
false
https://artifactory.example.com/artifactory/mvn-libs-release
snapshots
mvn-libs-snapshot
https://artifactory.example.com/artifactory/mvn-libs-snapshot
central
mvn-plugins-release
false
https://artifactory.example.com/artifactory/mvn-plugins-release
snapshots
mvn-plugins-snapshot
https://artifactory.example.com/artifactory/mvn-plugins-snapshot
artifactory
```
And here is my simplest-repro POM, having basically one entry in dependency management and nothing else:
```xml
4.0.0
com.example
untitled
1.0-SNAPSHOT
pom
org.springframework.boot
spring-boot-dependencies
3.5.6
import
pom
```
Then I run `mvn -X -N clean install` and see the following entries:
```
[DEBUG] Creating adapter using nameMapper 'gav' and factory 'rwlock-local'
[DEBUG] Resolving artifact org.springframework.boot:spring-boot-dependencies:pom:3.5.6 from [central (https://artifactory.example.com/artifactory/mvn-libs-release, default, releases), snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots)]
[DEBUG] Resolving artifact org.springframework.boot:spring-boot-dependencies:pom:3.5.6 from [central (https://artifactory.example.com/artifactory/mvn-libs-release, default, releases), snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots)]
[DEBUG] Using transporter HttpTransporter with priority 5.0 for https://artifactory.example.com/artifactory/mvn-libs-release
[DEBUG] Using connector BasicRepositoryConnector with priority 0.0 for https://artifactory.example.com/artifactory/mvn-libs-release with username=kg@example.com, password=***
Downloading from central: https://artifactory.example.com/artifactory/mvn-libs-release/org/springframework/boot/spring-boot-dependencies/3.5.6/spring-boot-dependencies-3.5.6.pom
Progress (1): spring-boot-dependencies-3.5.6.pom (7.6/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (16/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (32/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (49/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (65/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (81/96 kB)
Progress (1): spring-boot-dependencies-3.5.6.pom (96 kB)
Downloaded from central: https://artifactory.example.com/artifactory/mvn-libs-release/org/springframework/boot/spring-boot-dependencies/3.5.6/spring-boot-dependencies-3.5.6.pom (96 kB at 222 kB/s)
[DEBUG] Writing tracking file 'D:\Dev\.m2\repository\org\springframework\boot\spring-boot-dependencies\3.5.6\_remote.repositories'
[DEBUG] Writing tracking file 'D:\Dev\.m2\repository\org\springframework\boot\spring-boot-dependencies\3.5.6\spring-boot-dependencies-3.5.6.pom.lastUpdated'
[DEBUG] Resolving artifact org.apache.activemq:activemq-bom:pom:6.1.7 from [snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots), central (https://repo.maven.apache.org/maven2, default, releases)]
[DEBUG] Resolving artifact org.apache.activemq:activemq-bom:pom:6.1.7 from [snapshots (https://artifactory.example.com/artifactory/mvn-libs-snapshot, default, releases+snapshots), central (https://repo.maven.apache.org/maven2, default, releases)]
[DEBUG] Using transporter HttpTransporter with priority 5.0 for https://artifactory.example.com/artifactory/mvn-libs-snapshot
[DEBUG] Using connector BasicRepositoryConnector with priority 0.0 for https://artifactory.example.com/artifactory/mvn-libs-snapshot
Downloading from snapshots: https://artifactory.example.com/artifactory/mvn-libs-snapshot/org/apache/activemq/activemq-bom/6.1.7/activemq-bom-6.1.7.pom
[DEBUG] Writing tracking file 'D:\Dev\.m2\repository\org\apache\activemq\activemq-bom\6.1.7\activemq-bom-6.1.7.pom.lastUpdated'
[DEBUG] Using transporter HttpTransporter with priority 5.0 for https://repo.maven.apache.org/maven2
[DEBUG] Using connector BasicRepositoryConnector with priority 0.0 for https://repo.maven.apache.org/maven2 with username=kg@example.com, password=*** via proxy.example.com:8080
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-bom/6.1.7/activemq-bom-6.1.7.pom
Progress (1): activemq-bom-6.1.7.pom (799 B)
Progress (1): activemq-bom-6.1.7.pom (1.9 kB)
Progress (1): activemq-bom-6.1.7.pom (7.9 kB)
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/activemq/activemq-bom/6.1.7/activemq-bom-6.1.7.pom (7.9 kB at 53 kB/s)
```
As you can see, for some reason, Maven falls back to `https://repo.maven.apache.org/maven2` for no good reason.
Removing the import makes repositories work as expected (even though in a given example there is nothing to download, downloading works as expected for any added dependencies).
I understand that `spring-boot-dependencies` is quite a big POM to import, but I couldn't come with a simpler example. Copying all `` section (which itself has some transitive imports) to my POM did not reproduce the issue. Even `mvn clean install`ing the `spring-boot-dependencies` POM itself does not reproduce the issue.
I cannot see any repositories configuration in `spring-boot-dependencies` (having them there and being a reason for that behavior would be weird but would explain it at least to some extent).
Here is what I see in `mvn help:effective-pom` (no trace of resurrected maven.apache.org either):
```xml
false
central
mvn-libs-release
https://artifactory.example.com/artifactory/mvn-libs-release
true
snapshots
mvn-libs-snapshot
https://artifactory.example.com/artifactory/mvn-libs-snapshot
false
central
mvn-plugins-release
https://artifactory.example.com/artifactory/mvn-plugins-release
true
snapshots
mvn-plugins-snapshot
https://artifactory.example.com/artifactory/mvn-plugins-snapshot
```
I managed to reproduce it on Maven 3.8.9 and 3.9.11.
Is there any explanation and workaround for such a behavior?
Contributor guide
Research direction
Reproduce the behavior with the supplied settings.xml and minimal POM on Maven 3.8.9 or 3.9.11, using mvn -X -N clean install. Start with the debug resolution entries for the imported spring-boot-dependencies BOM and compare them with the effective POM. Done means identifying why the imported dependency causes Maven Central to be used and documenting a verified workaround or fix scope.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100