Uploaded image for project: 'Dev - Nexus Repo'
  1. Dev - Nexus Repo
  2. NEXUS-12249

nxrm3 exposes maven snapshot version numbers in project metadata in release-only proxy repos

    Details

    • Notability:
      3

      Description

      as a simple example, create a proxy repo in nx2 that points to the jboss repo (http://repository.jboss.org/nexus/content/groups/public/), but set the repository policy to Release. Next, create a group that includes maven-central and the jboss repo. Since the jboss repo hosts both snapshots and releases, you can see snapshot versions in the metadata for this project here:

      $ curl http://repository.jboss.org/nexus/content/groups/public/org/quickfixj/quickfixj-codegenerator/maven-metadata.xml
      <?xml version="1.0" encoding="UTF-8"?>
      <metadata modelVersion="1.1.0">
        <groupId>org.quickfixj</groupId>
        <artifactId>quickfixj-codegenerator</artifactId>
        <versioning>
          <latest>1.7.0-SNAPSHOT</latest>
          <versions>
            <version>1.6.4-SNAPSHOT</version>
            <version>1.7.0-SNAPSHOT</version>
          </versions>
          <lastUpdated>20161215051513</lastUpdated>
        </versioning>
      </metadata>
      

      However, when you do the same request against the group repository, those snapshot versions are not in the project metadata:

      $ curl http://localhost:8081/nexus/content/groups/public2/org/quickfixj/quickfixj-codegenerator/maven-metadata.xml
      <?xml version="1.0" encoding="UTF-8"?>
      <metadata>
        <groupId>org.quickfixj</groupId>
        <artifactId>quickfixj-codegenerator</artifactId>
        <versioning>
          <latest>1.6.3</latest>
          <release>1.6.3</release>
          <versions>
            <version>1.6.2</version>
            <version>1.6.3</version>
          </versions>
          <lastUpdated>20161215051513</lastUpdated>
        </versioning>
      </metadata>
      

      In nx3, the behavior is not preserved. As an experiment, I created a hosted repo that has a release policy of "mixed," allowing both snapshots and releases. I called it snapsandrels. Next, I created a proxy repo with a release policy of Release and pointed it to snapsandrels. Last, I created a group repository that included the release-only proxy to snapsandrels and maven central (so that I could build a project against it). After deploying a snapshot directly to snapsandrels, you can grab the project metadata from the group repository:

      $ curl http://localhost:8081/repository/public2/org/sonatype/wes/simplem2project/maven-metadata.xml
      <?xml version="1.0" encoding="UTF-8"?>
      <metadata modelVersion="1.1.0">
        <groupId>org.sonatype.wes</groupId>
        <artifactId>simplem2project</artifactId>
        <versioning>
          <latest>0.0.5-SNAPSHOT</latest>
          <versions>
            <version>0.0.5-SNAPSHOT</version>
          </versions>
          <lastUpdated>20170124160213</lastUpdated>
        </versioning>
      </metadata>
      

      However, nx3 doesn't let you retrieve that snapshot artifact because of the release policy.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              wwannemacher Wes Wannemacher [X] (Inactive)
              Last Updated By:
              Joe Tom Joe Tom
              Team:
              NXRM - Mad Max
              Votes:
              1 Vote for this issue
              Watchers:
              8 Start watching this issue

                Dates

                Created:
                Updated:
                Date of First Response:

                  tigCommentSecurity.panel-title