[MNG-6420] ComparableVersion incorrectly parses certain version strings

**[Ross Goldberg](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=xdr)** opened **[MNG-6420](https://issues.apache.org/jira/browse/MNG-6420?redirect=false)** and commented

For certain version strings, ComparableVersion doesn't follow the Maven version order spec (https://maven.apache.org/pom.html#Version_Order_Specification), and/or produces canonical versions that are incongruent with both the spec and the code's ordering.

To improve the code & fix the following bugs, I completely rewrote the version parser (using Java 8). I will create a PR sometime soon.

**Bug 1: comparison violates spec ordering**
 
java -jar /usr/local/Cellar/maven/3.5.3/libexec/lib/maven-artifact-3.6.3.jar 1-0.3 1
 
Outputs:
 
1. 1-0.3 == 1-0.3
   1-0.3 == 1
2. 1 == 1
 
This problem stems from:
 
https://github.com/apache/maven/blob/b8c06e61ab73cd9e25a5b2c93d9e5077b2196751/maven-artifact/src/main/java/org/apache/maven/artifact/versioning/ComparableVersion.java#L295-L296
 
 
 
**Bug 2: canonical incongruent with spec and code ordering**
 
java -jar /usr/local/Cellar/maven/3.5.3/libexec/lib/maven-artifact-3.6.3.jar 1-0-2 1-0.1
 
3. 1-0-2 == 1-2
   1-0-2 < 1-0.1
4. 1-0.1 == 1-0.1
 
This problem stems from retaining ListItems that, after normalization, have no children other than the subsequent ListItem.  Removing the unnecessary ListItem should fix this (i.e. remove the extraneous ListItem (named extraneous) from its parent ListItem (named parent), then add the only child of extraneous to parent).

---

**Affects:** 3.5.3, 3.6.3

**Issue Links:**
- [MNGSITE-387](https://issues.apache.org/jira/browse/MNGSITE-387) semver version strings comparison

1 votes, 6 watchers

Start with maven-artifact/src/main/java/org/apache/maven/artifact/versioning/ComparableVersion.java, especially the normalization logic around the referenced lines. Check the reported version pairs against the Maven Version Order Specification and the current parser behavior. Done means the comparison and canonical forms agree with the specification for these cases, with regression coverage for both bugs.

Written by the indexing model from the issue text.