I'm attempting to upgrade from an older version of resteasy-jaxb-provider (3.0.6) to 4.0.0.Final due to some dependency conflicts on a larger project that got resteasy-jackson2-provider, several com.fasterxml.jackson.core dependency version bumps and jackson-databind version bumps for unrelated reasons.
My question is about the maven packaging/pom configuration. I am using a the maven-ant-tasks plugin from Apache (but I see the same issue/warning messages resolving dependencies from maven central through the mvn command line directly). The problem with the ant task may be three-fold: The ant-maven task errors out when it can't read the poms (this is probably mostly a me/us problem with our tooling). Secondly, it looks like some of the pom configuration in the resteasy/jboss projects is possibly too complicated for it or possibly even misconfigured (the errors I see in both maven and ant tasks are related to not finding the parent-pom for the project). Finally, the third issue I noticed may be a regression in maven 3.6.1 that causes it not to follow redirects.
That's a lot to parse, but let me break it down into pieces to see if somebody may have an idea for a better way to resolve this issue.
1.) When upgrading to 4.0.0.Final (after fixing two or three differences due to functionality changes, getting everything compiling), I am getting the following errors when pulling it from the repo:
[artifact:dependencies] Transferring 8K from singlewire.public
[artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote = '<html>
[artifact:dependencies] <head><title>301' - RETRYING
[artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote = '<html>
[artifact:dependencies] <head><title>301' - IGNORING
[artifact:dependencies] An error has occurred while processing the Maven artifact tasks.
[artifact:dependencies] Diagnosis:
[artifact:dependencies]
[artifact:dependencies] Unable to resolve artifact: Unable to get dependency information: Unable to read the metadata file for artifact 'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent: com.sun.xml.bind:jaxb-bom-ext for project: com.sun.xml.bind.mvn:jaxb-parent:pom:null for project com.sun.xml.bind.mvn:jaxb-parent:pom:null
[artifact:dependencies] org.glassfish.jaxb:jaxb-runtime:jar:2.3.1
[artifact:dependencies]
[artifact:dependencies] from the specified remote repositories:
[artifact:dependencies]
[artifact:dependencies] Path to dependency:
[artifact:dependencies] 1) my.project:war:12.9.1-SNAPSHOT
[artifact:dependencies] 2) org.jboss.resteasy:resteasy-jaxb-provider:jar:4.0.0.Final
2.) When I inspect the contents of the repo it's crashing on, jaxb-bom-ext, this is the content of ~/.m2/repository/com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom:
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
3.) When I investigate our nexus repo and directly download the file, it seems to contain the appropriate content, as does the repo at
maven.java.net:
https://maven.java.net/content/repositories/releases/com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom<link type="text/css" id="dark-mode" rel="stylesheet" href=""/>
<style type="text/css" id="dark-mode-custom-style"/>
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.glassfish.jaxb</groupId>
<artifactId>jaxb-bom</artifactId>
<relativePath>../bom/pom.xml</relativePath>
<version>2.3.1</version>
</parent>
<groupId>com.sun.xml.bind</groupId>
<artifactId>jaxb-bom-ext</artifactId>
<packaging>pom</packaging>
<name>JAXB BOM with ALL dependencies</name>
<description>
JAXB Bill of Materials (BOM) with all dependencies. If you are not sure - DON'T USE THIS BOM. Use com.sun.xml.bind:jaxb-bom instead.
</description>
...
Visiting the actual site redirects to
https, so that may be the initial cause for the 301- mvn is downloading the 301 error page into the "pom" location, which is really strange behavior. The only thing I found from googling around for this issue is a decade-old
bug report of this happening in 2010 that has long since been closed/fixed/merged. ¯\_(ツ)_/¯
When I visited the maven central repo and grabbed the jaxb-bom-ext-2.3.1.pom then manually shoved it into my local m2 repo, I got slightly further-
[artifact:dependencies] Unable to resolve artifact: Unable to get dependency information: Unable to read the metadata file for artifact 'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent: org.glassfish.jaxb:jaxb-bom for project: com.sun.xml.bind:jaxb-bom-ext:pom:null for project com.sun.xml.bind:jaxb-bom-ext:pom:null
[artifact:dependencies] org.glassfish.jaxb:jaxb-runtime:jar:2.3.1
My local m2 version of the pom for the jaxb-bom dependency looks like this:
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
When I do the same manual installation procedure for jaxb-bom as for jaxb-bom-ext above, everything is happy:
[artifact:dependencies] Transferring 4K from singlewire.public
[artifact:dependencies] Transferring 69K from singlewire.public
I get two additional artifacts form jaxb and I'm off to the races.
Super strange behavior, but after struggling with this and our build tools for a couple of days, I decided to just revert back from 4.0.0.Final to 3.0.6.Final, manually exclude and pull versions are compatible across those versions (jackson-module-jaxb-annotations and jaxrs-api, specifically) some conflicts and I have no issues pulling dependencies. I'd like to pull in the latest dependencies, since I'm sure there are performance and security tweaks here and there that would be nice to pick up, and it seems really strange that maven's behavior is blocking this.
Any thoughts or theories?
--