Maven dependency:get get LATEST ignore repositories from settings.xml

Question

I'm trying to download the last snapshot version from my remote repository (Artifactory. To do that, I'm using the following command:

mvn dependency:get \
  -Dartifact=com.acme:my-application:LATEST:war \
  -DremoteRepositories=http://localhost:8085/artifactory/libs-snapshots-local/

The libs-snapshot-local repository is the part of Artifactory in which all snapshots are stored. If I open the maven-metadata.xml file on the following path:

http://localhost:8085/artifactory/libs-snapshots-local/com/acme/my-application/maven-metadata.xml

Then I get the following XML response:

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>com.acme</groupId>
  <artifactId>my-application</artifactId>
  <version>2.0.0-20160222.105839-1</version>
  <versioning>
    <latest>2.0.0-SNAPSHOT</latest>
    <versions>
      <version>2.0.0-SNAPSHOT</version>
    </versions>
    <lastUpdated>20160223132257</lastUpdated>
  </versioning>
</metadata>

So, according to this file, the WAR with version2.0.0-SNAPSHOT should be the one that is retrieved.

However when I execute the command, I get the following response:

[INFO] Scanning for projects...
[INFO]                                                                         
[INFO] ------------------------------------------------------------------------
[INFO] Building Maven Stub Project (No POM) 1
[INFO] ------------------------------------------------------------------------
[INFO] 
[INFO] --- maven-dependency-plugin:2.8:get (default-cli) @ standalone-pom ---
[INFO] Resolving com.acme:my-application:war:LATEST with transitive dependencies
Downloading: http://download.java.net/maven/2/com/acme/my-application/maven-metadata.xml
Downloading: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/maven-metadata.xml
Downloading: http://repo1.maven.org/maven2/com/acme/my-application/maven-metadata.xml
Downloading: http://localhost:8085/artifactory/libs-snapshots/com/acme/my-application/maven-metadata.xml
Downloading: http://localhost:8085/artifactory/libs-snapshots-local/com/acme/my-application/maven-metadata.xml
Downloaded: http://localhost:8085/artifactory/libs-snapshots-local/com/acme/my-application/maven-metadata.xml (378 B at 23.1 KB/sec)
Downloaded: http://localhost:8085/artifactory/libs-snapshots/com/acme/my-application/maven-metadata.xml (378 B at 0.5 KB/sec)
Downloaded: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/maven-metadata.xml (898 B at 0.6 KB/sec)
Downloading: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/1.0.0/my-application-1.0.0.pom
Downloaded: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/1.0.0/my-application-1.0.0.pom (26 KB at 1475.0 KB/sec)
Downloading: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/1.0.0/my-application-1.0.0.war
Downloaded: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/1.0.0/my-application-1.0.0.war (77415 KB at 9657.4 KB/sec)

It looks like the dependency:get goal is trying to download the artifact by looking at all the repositories inside my settings.xml file and the -DremoteRepositories parameter.

Due to this, it's looking at my releases repository as well, which contains a release 1.0.0 which was uploaded later than the 2.2.0-SNAPSHOT.

My settings.xml file looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
                      http://maven.apache.org/xsd/settings-1.0.0.xsd">

    <pluginGroups>
        <pluginGroup>org.mortbay.jetty</pluginGroup>
    </pluginGroups>
    <profiles>
        <profile>
            <repositories>
                <repository>
                    <snapshots>
                        <enabled>false</enabled>
                    </snapshots>
                    <id>central</id>
                    <name>libs-releases</name>
                    <url>http://localhost:8085/artifactory/libs-releases</url>
                </repository>
                <repository>
                    <snapshots />
                    <id>snapshots</id>
                    <name>libs-snapshots</name>
                    <url>http://localhost:8085/artifactory/libs-snapshots</url>
                </repository>
                <repository>
                    <id>Maven</id>
                    <name>Maven Repository</name>
                    <url>http://repo1.maven.org/maven2/</url>
                </repository>
                <repository>
                    <id>Java</id>
                    <name>Java Repository</name>
                    <url>http://download.java.net/maven/2/</url>
                </repository>
            </repositories>
            <id>artifactory</id>
        </profile>
    </profiles>
    <activeProfiles>
        <activeProfile>artifactory</activeProfile>
    </activeProfiles>
</settings>

Is there a way to tell the maven-dependency-plugin not to be using the repositories defined in the settings.xml and only the dependency given within the command?

Why not simply using maven itself by using `mvn -U ...`? – khmarbaise Feb 23 '16 at 17:12 — khmarbaise, Feb 23 '16 at 17:12

score 2 · Accepted Answer · edited May 23 '17 at 12:09

Reading the source code, what you are describing is exactly the behaviour of the dependency:get goal. It will add to the remoteRepositories specified on the command line, the list of the current active repositories.

Copying the code here for reference:

if ( pomRemoteRepositories != null )
{
    repoList.addAll( pomRemoteRepositories );
}

one can see that the repoList variable, that is later used for the list of repositories to check, will always contain the active repositories and that there is currently no way around that.

The list of active repositories is retrieved with:

@Parameter( defaultValue = "${project.remoteArtifactRepositories}", readonly = true, required = true )
private List<ArtifactRepository> pomRemoteRepositories;

meaning also that this can't be overriden at the command line (it is readonly and there is no user property).

So in your case, it results in all of your repositories defined under the artifactory profile to be used also, since it is declared active.

The only possible workaround that I can see would be to invoke Maven with a default settings.xml file (the one in the Maven installation for example). Or create a feature request at their Jira to ask for this use-case (I couldn't find any relating to this).

Maven dependency:get get LATEST ignore repositories from settings.xml

1 Answers1