From max.magee at singlewire.com Thu May 16 15:54:03 2019 Content-Type: multipart/mixed; boundary="===============2774909161852003638==" MIME-Version: 1.0 From: Max Magee To: resteasy-dev at lists.jboss.org Subject: Re: [resteasy-dev] Pom/Bom dependency issue Date: Thu, 16 May 2019 14:53:49 -0500 Message-ID: In-Reply-To: CAM_r5cjGEEQFSdhZ_EkM6Q37rM2sK3zfED0pceR0+e6cuz34VA@mail.gmail.com --===============2774909161852003638== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Thanks for the response. First, excellent advice. I did jump right into 4.0.0.Final, and subsequently broke a bunch of things (even after working around the nexus/maven issues). Most of them were minor and related to CompletableFutures/asynchronously resolving responses and the way ResteasyClientBuilder worked (including having to set auth headers on the RestesyWebTarget instead of the client). After that, everything worked like gangbusters except for my nexus issues, which are really, I think what the question is about. I reverted the version bump not because it wasn't compiling- it was- but because I couldn't get our CI tools to process the pom/bom infrastructure, and therefore wasn't confident that all the kinks were worked out with this version (it may just be an environment issue on my end, we use a nexus sonatype repo in between to cache most of our deps in house, but it seemed to pick up every change and its copies of the repos looked pristine to me when I downloaded from our server). The maven repo that I was pointed at seems to contain the correct data, just under the https domain. I specified the repo I was trying to pull from in my project's pom- MAXs.java.net java releases https://maven.java.net/content/repositores/releases I'm definitely not a maven maven- is there a difference between adding the repo in my settings.xml and the project pom (in terms of this particular project)? I tried it both ways (in pom and settings), and it worked for both in the mvn dependency:resolve task but failed for both within the ant-maven plugin. It seems that ant is just stupid about following 301 redirects when resolving complex dependencies. And I saw console messages that indicated that maven tried there after failing to validate the nexus cached copies against the error response content. [artifact:dependencies] Downloading: org/glassfish/jaxb/jaxb-runtime/2.3.1/jaxb-runtime-2.3.1.pom from repository nexus.public at http://nexus.local.lan:8081/nexus/content/groups/public/ [artifact:dependencies] Transferring 8K from nexus.local [artifact:dependencies] Downloading: com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository releases.java.net at http://maven.java.net/content/repositories/releases/ [artifact:dependencies] Transferring 0K from* releases.java.net * [artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on download: local =3D '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =3D ' [artifact:dependencies] 301' - RETRYING [artifact:dependencies] Downloading: com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository releases.java.net at http://maven.java.net/content/repositories/releases/ [artifact:dependencies] Transferring 0K from releases.java.net [artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on download: local =3D '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =3D '<html> [artifact:dependencies] <head><title>301' - IGNORING [artifact:dependencies] An error has occurred while processing the Maven artifact tasks. [artifact:dependencies] Diagnosis: [artifact:dependencies] [artifact:dependencies] Unable to resolve artifact: Unable to get dependency information: Unable to read the metadata file for artifact 'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent: com.sun.xml.bind:jaxb-bom-ext for project: com.sun.xml.bind.mvn:jaxb-parent:pom:null for project com.sun.xml.bind.mvn:jaxb-parent:pom:null [artifact:dependencies] org.glassfish.jaxb:jaxb-runtime:jar:2.3.1 [artifact:dependencies] [artifact:dependencies] from the specified remote repositories: [artifact:dependencies] nexus.mirror ( http://nexus:8081/nexus/content/groups/public/), [artifact:dependencies] central (http://repo1.maven.org/maven2), [artifact:dependencies] nexus.local ( http://nexus.local.lan:8081/nexus/content/groups/public/), *[artifact:dependencies] MAXs.java.net <http://MAXs.java.net> (https://maven.java.net/content/repositores/releases <https://maven.java.net/content/repositores/releases>)* -------- I don't really understand all the complexities of our build process, but you're making me think I'm not insane, so that's something. I think the problem may be with the maven-ant-tasks project that we're relying on, rather than just the complexity of the pom/bom/parent infrastructure (it's triggering the problems I'm having, but is probably not THE problem). <path id=3D"maven-ant-tasks.classpath" path=3D"etc/buildhelper/maven-ant-tasks-2.1.3.jar" /> <typedef resource=3D"org/apache/maven/artifact/ant/antlib.xml" uri=3D"antlib:org.apache.maven.artifact.ant" classpathref=3D"maven-ant-tasks.classpath" /> https://maven.apache.org/ant-tasks/ It doesn't make me happy to see this at the top of the page- Maven Ant Tasks*Note: This component is retired. It is no longer maintained.* Thanks for your feedback, I appreciate it. Max On Thu, May 16, 2019 at 12:48 PM Rebecca Searls <rsearls(a)redhat.com> wrot= e: > As you have noted, you have quite a lot going on here. > * You've noted there may be a maven versioning issue. > * Some of the messages indicate some archives have been removed from so= me > of the repositories you are referencing or are corrupt. > * Moving from 3.0.6 to 4.0.0.Final is a big jump. I would not expect > this > to be an issue but it is. > > I would suggest taking the following approach in identifying and addressi= ng > these issues. > There have been 14 final resteasy releases between 3.0.6.Final and > 4.0.0.Final. > I would try getting a clean compile of just resteasy itself starting > with 3.1.0.Final, > then 3.5.0.Final, 3.6.0.Final and finally 4.0.0.Final. This should be > helpful > in identifying a maven version issue. You may also need to find a new > nexus repo > that contains the archive versions that appear to be missing or > corrupt. Make > updates in your maven settings.xml file. When experimenting with my > settings.xml > declarations I usually work from a copy of my settings file and build > the project > referencing the copy like this > mvn -s ./settings-experiment.xml clean install -DskipTests > > Once you get a clean compile of 4.0.0.Final, then go back and try > building > within your working project. > > On Thu, May 16, 2019 at 12:49 PM Max Magee <max.magee(a)singlewire.com> > wrote: > >> Hi All, >> >> I'm attempting to upgrade from an older version of resteasy-jaxb-provider >> (3.0.6) to 4.0.0.Final due to some dependency conflicts on a larger proj= ect >> that got resteasy-jackson2-provider, several com.fasterxml.jackson.core >> dependency version bumps and jackson-databind version bumps for unrelated >> reasons. >> >> My question is about the maven packaging/pom configuration. I am using a >> the maven-ant-tasks plugin from Apache (but I see the same issue/warning >> messages resolving dependencies from maven central through the mvn comma= nd >> line directly). The problem with the ant task may be three-fold: The >> ant-maven task errors out when it can't read the poms (this is probably >> mostly a *me/us *problem with our tooling). Secondly, it looks like some >> of the pom configuration in the resteasy/jboss projects is possibly too >> complicated for it or possibly even misconfigured (the errors I see in b= oth >> maven and ant tasks are related to not finding the parent-pom for the >> project). Finally, the third issue I noticed may be a regression in maven >> 3.6.1 that causes it not to follow redirects. >> >> That's a lot to parse, but let me break it down into pieces to see if >> somebody may have an idea for a better way to resolve this issue. >> >> 1.) When upgrading to 4.0.0.Final (after fixing two or three differences >> due to functionality changes, getting everything compiling), I am getting >> the following errors when pulling it from the repo: >> [artifact:dependencies] Downloading: >> org/glassfish/jaxb/jaxb-runtime/2.3.1/jaxb-runtime-2.3.1.pom from >> repository singlewire.public at >> http://nexus.singlewire.lan:8081/nexus/content/groups/public/ >> [artifact:dependencies] Transferring 8K from singlewire.public >> [artifact:dependencies] Downloading: >> com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from reposito= ry >> releases.java.net at http://maven.java.net/content/repositories/releases/ >> [artifact:dependencies] Transferring 0K from releases.java.net >> [artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed >> on download: local =3D '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remot= e =3D >> '<html> >> [artifact:dependencies] <head><title>301' - RETRYING >> [artifact:dependencies] Downloading: >> com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from reposito= ry >> releases.java.net at http://maven.java.net/content/repositories/releases/ >> [artifact:dependencies] Transferring 0K from releases.java.net >> [artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed >> on download: local =3D '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remot= e =3D >> '<html> >> [artifact:dependencies] <head><title>301' - IGNORING >> *[artifact:dependencies] An error has occurred while processing the Maven >> artifact tasks.* >> *[artifact:dependencies] Diagnosis:* >> *[artifact:dependencies]* >> *[artifact:dependencies] Unable to resolve artifact: Unable to get >> dependency information: Unable to read the metadata file for artifact >> 'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent: >> com.sun.xml.bind:jaxb-bom-ext for project: >> com.sun.xml.bind.mvn:jaxb-parent:pom:null for project >> com.sun.xml.bind.mvn:jaxb-parent:pom:null* >> *[artifact:dependencies] org.glassfish.jaxb:jaxb-runtime:jar:2.3.1* >> [artifact:dependencies] >> [artifact:dependencies] from the specified remote repositories: >> [artifact:dependencies] singlewire.mirror ( >> http://nexus:8081/nexus/content/groups/public/), >> [artifact:dependencies] central (http://repo1.maven.org/maven2), >> [artifact:dependencies] singlewire.public ( >> http://nexus.singlewire.lan:8081/nexus/content/groups/public/) >> [artifact:dependencies] >> [artifact:dependencies] Path to dependency: >> [artifact:dependencies] 1) my.project:war:12.9.1-SNAPSHOT >> [artifact:dependencies] 2) >> org.jboss.resteasy:resteasy-jaxb-provider:jar:4.0.0.Final >> >> 2.) When I inspect the contents of the repo it's crashing on, >> jaxb-bom-ext, this is the content of >> ~/.m2/repository/com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.= pom: >> <html> >> <head><title>301 Moved Permanently >> >>

301 Moved Permanently

nginx/1.12.1 >> >> >> >> 3.) When I investigate our nexus repo and directly download the file, it >> seems to contain the appropriate content, as does the repo at >> maven.java.net: >> >> https://maven.java.net/content/repositories/releases/com/sun/xml/bind/ja= xb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom >> > http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=3D" >> http://maven.apache.org/POM/4.0.0 >> http://maven.apache.org/maven-v4_0_0.xsd"> >> >>