0

I am working on a big project with many maven dependencies where some of them may be transitive ones.

I would like to know how maven packages the SNAPSHOT dependencies, because when I open an artifact I see that sometimes the libraries are packaged with SNAPSHOT in their name and other times there is a timestamp, like in this picture:

enter image description here

What worries me the most is that even packaging with -U argument the SNAPSHOT libraries not always correspond to the latest version available on the repository.

In the pom.xml the dependency versions are always ending in "-SNAPSHOT" and we are using maven 3.3.3.

Javi
  • 139
  • 1
  • 2
  • 12
  • Please put text instead of images many people reading here have firewall limitations...You are talking about packaging. What kind of packaging ? WAR's / EAR's / JAR's / ZIP ? How are you doing this? Best would be full pom files...Sometimes people use maven-assembly-plugin with packaging from target folder which can result to such things. etc... – khmarbaise Jul 04 '17 at 13:45

1 Answers1

1

Snapshots are handled differently in local repository and in remote repositories.

The mvn install installs SNAPSHOTS as -SNAPSHOT to the local repository which is fine for local builds. The remote repositories contains the SNAPSHOT versions with timestamps as they are results of mvn deploy.

During local builds these two can mix as it is possible that one artifact is the result of the local build (-SNAPSHOT) and the other is downloaded from a remote repository (-20170623.063055-4).

The real problem is that they can mix in an unexpected way. Maven tries its best to obtain the latest SNAPSHOT from any available repository. This will most likely happen when you use the -U as it forces the check on remote repositories.

Sometimes this results an error: lib-a and lib-b are both dependencies, you built both 5 min ago, however the CI built lib-a 3 min ago then the build will use the CI lib-a and your lib-b as the CI has a newer version. If you modified something in the lib-a but the CI's lib-a does not contain it as it is not yet committed then it will be a very annoying issue.

The best strategy is to avoid deploying snapshots to remote repositories.

This is a good article regarding the repository internals: https://blog.packagecloud.io/eng/2017/03/09/how-does-a-maven-repository-work/

Also there is a related SO answer: https://stackoverflow.com/a/32416454/8230378

Gebezs
  • 696
  • 3
  • 9