How does Maven choose which .jar to use when it downloads 2 identical jars from different repositories

Question

Sorry for the long description:

Background: I have 2 projects, let's say A and B. Builds in Project A deploy to Nexus Repository Manager OSS 2.12.0 repo A, and builds in Project B deploy to Nexus repo B. My maven project needs to use .jars from both repo A and repo B.

Therefore, I configured my maven.settings file to use 2 different Nexus repositories (Having 2 mirrors).

Now, I see that when I compile my maven project, it will go through repo A, search for the jar, then go through repo B, search for the jar. When it finds the jar, it will download it.

Problem: I used to use Repo B for both project A and project B's jars (the owner of the repo kicked me out). Therefore, I now have the same 0.0.1-SNAPSHOT of a component in both repo A, and repo B.

Maven now downloads both these snapshots during compilation.

Question: How does maven resolve which .jar to use if both have the same name (ex: componentName-0.0.1-SNAPSHOT) ? I see that in my local ./m2 repository, there's a resolver-status file, but I'm unsure of how it resolves between both the jars. Ideally, I would want maven to use the most recently updated (based on timestamp) jar.

You shouldn't use revision timestamps as your primary means of selecting jars; use version numbers instead. — nanofarad, Oct 03 '16 at 20:41
Maybe just increment the version, e.g. `componentName-0.0.2-SNAPSHOT` — Taylor, Oct 03 '16 at 20:42
Possible duplicate of [How maven handle multiple configurations?](http://stackoverflow.com/questions/34238196/how-maven-handle-multiple-repository-configurations) — A_Di-Matteo, Oct 03 '16 at 20:43

score 5 · Answer 1 · answered Oct 04 '16 at 00:08

Short answer: Whichever repository comes first in the effective POM that is computed by maven. (You can view your effective pom by running mvn help:effective-pom.)

Long answer:

The way maven resolves SNAPSHOT artifacts is (roughly) as follows:

1) Go through each dependency that has a SNAPSHOT version in <dependencies>

2) Walk through all repositories listed in <snapshotRepositories>

3) For each SNAPSHOT repository, check if there is a maven-metadata.xml file for that dependency's group, package name, and version.

For instance, given the package coordinates: io.packagecloud:jake:4.0-SNAPSHOT, it would look for /io/packagecloud/jake/4.0-SNAPSHOT/maven-metadata.xml in each configured repository.

4) If this file is found, then use it to find the latest artifact to dwonload. Taking a look at an example maven-metadata.xml:

$ curl -L https://packagecloud.io/capotej/snapshot_example/maven2/io/packagecloud/jake/4.0-SNAPSHOT/maven-metadata.xml

<?xml version="1.0" encoding="UTF-8"?>
<metadata modelVersion="1.1.0">
  <groupId>io.packagecloud</groupId>
  <artifactId>jake</artifactId>
  <version>4.0-SNAPSHOT</version>
  <versioning>
    <snapshot>
      <timestamp>20161003.234325</timestamp>
      <buildNumber>2</buildNumber>
    </snapshot>
    <lastUpdated>20161003234325</lastUpdated>
    <snapshotVersions>
      <snapshotVersion>
        <extension>jar</extension>
        <value>4.0-20161003.234325-2</value>
        <updated>20161003234325</updated>
      </snapshotVersion>
      <snapshotVersion>
        <extension>pom</extension>
        <value>4.0-20161003.234325-2</value>
        <updated>20161003234325</updated>
      </snapshotVersion>
    </snapshotVersions>
  </versioning>
</metadata>

We can see that the <lastUpdated> timestamp is 20161003234325. Using this timestamp, we can then look it up in <snapshotVersions> to get the full value, in this case it's: 4.0-20161003.234325-2.

5) Now maven knows the full, unique version of this SNAPSHOT, and it can download it from the repository:

curl -I https://packagecloud.io/capotej/snapshot_example/maven2/io/packagecloud/jake/4.0-SNAPSHOT/jake-4.0-20161003.234325-2.jar

Hope this answers your question!

Related:

Maven repository support

SBT SNAPSHOT Deploys and fatjar Support

Would the same apply if Nexus had say, 1 hosted and 2 proxy repositories which contained the same jar? If Proxy A happens to have a lastUpdated stamp on library X which is newer than Proxy B and Hosted repos, it'll be chosen? — f1dave, Feb 01 '17 at 03:16
`Versions from each examined metadata file are merged to find latest version (based on timestamp from metadata).` [Using Maven with OSGi Part 3](https://ggrzybek.blogspot.com/2016/10/using-maven-with-osgi-part-3.html) — schemacs, Apr 26 '21 at 09:45

How does Maven choose which .jar to use when it downloads 2 identical jars from different repositories

1 Answers1