To formalize and expand on the “update” in the question (by the way you should not hesitate to answer your own question):
I came to a similar conclusion independently and include
find -L ~/.m2/repository \( -type d -name '*-SNAPSHOT' -prune -o -type f -name maven-metadata-local.xml \) -exec rm -rfv {} \;
in a general “cleanup” script that I run from time to time. Note that this differs from the ideal of install:install
always going to a separate location in (at least) three ways:
- You have to remember to run this script, so in the meantime you could have a local repository “polluted” with things you built. On occasion this will mean that a build will work locally for you but will not work for others. (Or even fail only or you, or succeed for everyone but behave subtly differently.) This defeats the goal of reproducible builds, unless you have plenty of Internet bandwidth and are willing to run
docker run --rm -v "$PWD":/usr/src/mymaven -w /usr/src/mymaven maven mvn clean install
!
- If someone has intentionally
deploy
ed SNAPSHOT
s to a shared repository, this script will delete them, so your next build will have to repeat the download.
- Local
install
s of release versions are not deleted. Now if these came from release:perform
because you were the one cutting the release, that is not so bad—presumably the remote artifact is identical to your local copy anyway. Where this gets really evil is if, in the course of trying to debug some problem in someone else’s released artifact by rebuilding from sources with some diagnostic patches (say), you forget to edit pom.xml
to use a SNAPSHOT
or other distinguishing version, and install
the result. Maven will never notice that your local copy differs from the official version, and you can get into weird situations months later. Of course this has never happened to me.
The latter two problems could perhaps be addressed with a more complicated script that parsed maven-metadata-*.xml
files rather than assuming that all, and only, SNAPSHOT
s were local builds. Or as the submitter hints at, just delete the whole version directory if maven-metadata-local.xml
is present (distinguishing this somehow from the parent artifact directory, which will also have such a file, and resolver-status.properties
too).
While it is nice that Maven 3 records some information about where artifacts in the local repository came from, it is not good enough. What I for one would really appreciate is if install:install
always saved to a distinct location, so that the main local repository could be trusted to be purely a cache of downloads. Local artifact resolution would then prefer one or the other repository in case of conflict based on a command-line switch (after issuing a warning).