11:07 a.m.
Hi All,
I'm attempting to upgrade from an older version of resteasy-jaxb-provider
(3.0.6) to 4.0.0.Final due to some dependency conflicts on a larger project
that got resteasy-jackson2-provider, several com.fasterxml.jackson.core
dependency version bumps and jackson-databind version bumps for unrelated
reasons.
My question is about the maven packaging/pom configuration. I am using a
the maven-ant-tasks plugin from Apache (but I see the same issue/warning
messages resolving dependencies from maven central through the mvn command
line directly). The problem with the ant task may be three-fold: The
ant-maven task errors out when it can't read the poms (this is probably
mostly a *me/us *problem with our tooling). Secondly, it looks like some of
the pom configuration in the resteasy/jboss projects is possibly too
complicated for it or possibly even misconfigured (the errors I see in both
maven and ant tasks are related to not finding the parent-pom for the
project). Finally, the third issue I noticed may be a regression in maven
3.6.1 that causes it not to follow redirects.
That's a lot to parse, but let me break it down into pieces to see if
somebody may have an idea for a better way to resolve this issue.
1.) When upgrading to 4.0.0.Final (after fixing two or three differences
due to functionality changes, getting everything compiling), I am getting
the following errors when pulling it from the repo:
[artifact:dependencies] Downloading:
org/glassfish/jaxb/jaxb-runtime/2.3.1/jaxb-runtime-2.3.1.pom from
repository singlewire.public at
http://nexus.singlewire.lan:8081/nexus/content/groups/public/
[artifact:dependencies] Transferring 8K from singlewire.public
[artifact:dependencies] Downloading:
com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository
releases.java.net at http://maven.java.net/content/repositories/releases/
[artifact:dependencies] Transferring 0K from releases.java.net
[artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on
download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =
'<html>
[artifact:dependencies] <head><title>301' - RETRYING
[artifact:dependencies] Downloading:
com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository
releases.java.net at http://maven.java.net/content/repositories/releases/
[artifact:dependencies] Transferring 0K from releases.java.net
[artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on
download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =
'<html>
[artifact:dependencies] <head><title>301' - IGNORING
*[artifact:dependencies] An error has occurred while processing the Maven
artifact tasks.*
*[artifact:dependencies] Diagnosis:*
*[artifact:dependencies]*
*[artifact:dependencies] Unable to resolve artifact: Unable to get
dependency information: Unable to read the metadata file for artifact
'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent:
com.sun.xml.bind:jaxb-bom-ext for project:
com.sun.xml.bind.mvn:jaxb-parent:pom:null for project
com.sun.xml.bind.mvn:jaxb-parent:pom:null*
*[artifact:dependencies] org.glassfish.jaxb:jaxb-runtime:jar:2.3.1*
[artifact:dependencies]
[artifact:dependencies] from the specified remote repositories:
[artifact:dependencies] singlewire.mirror (
http://nexus:8081/nexus/content/groups/public/),
[artifact:dependencies] central (http://repo1.maven.org/maven2),
[artifact:dependencies] singlewire.public (
http://nexus.singlewire.lan:8081/nexus/content/groups/public/)
[artifact:dependencies]
[artifact:dependencies] Path to dependency:
[artifact:dependencies] 1) my.project:war:12.9.1-SNAPSHOT
[artifact:dependencies] 2)
org.jboss.resteasy:resteasy-jaxb-provider:jar:4.0.0.Final
2.) When I inspect the contents of the repo it's crashing on, jaxb-bom-ext,
this is the content of
~/.m2/repository/com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom:
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
3.) When I investigate our nexus repo and directly download the file, it
seems to contain the appropriate content, as does the repo at maven.java.net
:
https://maven.java.net/content/repositories/releases/com/sun/xml/bind/jax...
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="
http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<link type="text/css" id="dark-mode" rel="stylesheet"
href=""/>
<style type="text/css" id="dark-mode-custom-style"/>
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.glassfish.jaxb</groupId>
<artifactId>jaxb-bom</artifactId>
<relativePath>../bom/pom.xml</relativePath>
<version>2.3.1</version>
</parent>
<groupId>com.sun.xml.bind</groupId>
<artifactId>jaxb-bom-ext</artifactId>
<packaging>pom</packaging>
<name>JAXB BOM with ALL dependencies</name>
<description>
JAXB Bill of Materials (BOM) with all dependencies. If you are not sure -
DON'T USE THIS BOM. Use com.sun.xml.bind:jaxb-bom instead.
</description>
...
That description isn't super-reassuring, but I assume the packager knows
what s/he *is *sure. I noticed, too, that although our repo is trying to
grab the dependency from *http://*maven.java.net
Downloading: com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom
from repository releases.java.net at
http://maven.java.net/content/repositories/releases/
Visiting the actual site redirects to *https*, so that may be the initial
cause for the 301- mvn is downloading the 301 error page into the "pom"
location, which is really strange behavior. The only thing I found from
googling around for this issue is a decade-old bug report of this happening
in 2010 <https://issues.apache.org/jira/browse/MNG-4734> that has long
since been closed/fixed/merged. ¯\_(ツ)_/¯
When I visited the maven central repo and grabbed the
jaxb-bom-ext-2.3.1.pom then manually shoved it into my local m2 repo, I got
slightly further-
[artifact:dependencies] Unable to resolve artifact: Unable to get
dependency information: Unable to read the metadata file for artifact
'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent:
*org.glassfish.jaxb:jaxb-bom* for project:
com.sun.xml.bind:jaxb-bom-ext:pom:null for project
com.sun.xml.bind:jaxb-bom-ext:pom:null
[artifact:dependencies] org.glassfish.jaxb:jaxb-runtime:jar:2.3.1
My local m2 version of the pom for the jaxb-bom dependency looks like this:
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
When I do the same manual installation procedure for jaxb-bom as for
jaxb-bom-ext above, everything is happy:
[artifact:dependencies] Downloading:
org/glassfish/jaxb/txw2/2.3.1/txw2-2.3.1.pom from repository
singlewire.public at
http://nexus.singlewire.lan:8081/nexus/content/groups/public/
[artifact:dependencies] Transferring 4K from singlewire.public
[artifact:dependencies] Downloading:
org/glassfish/jaxb/txw2/2.3.1/txw2-2.3.1.jar from repository
singlewire.public at
http://nexus.singlewire.lan:8081/nexus/content/groups/public/
[artifact:dependencies] Transferring 69K from singlewire.public
I get two additional artifacts form jaxb and I'm off to the races.
Super strange behavior, but after struggling with this and our build tools
for a couple of days, I decided to just revert back from 4.0.0.Final to
3.0.6.Final, manually exclude and pull versions are compatible across those
versions (jackson-module-jaxb-annotations and jaxrs-api, specifically) some
conflicts and I have no issues pulling dependencies. I'd like to pull in
the latest dependencies, since I'm sure there are performance and security
tweaks here and there that would be nice to pick up, and it seems really
strange that maven's behavior is blocking this.
Any thoughts or theories?
--
Max Magee
12:48 p.m.
As you have noted, you have quite a lot going on here.
* You've noted there may be a maven versioning issue.
* Some of the messages indicate some archives have been removed from some
of the repositories you are referencing or are corrupt.
* Moving from 3.0.6 to 4.0.0.Final is a big jump. I would not expect this
to be an issue but it is.
I would suggest taking the following approach in identifying and addressing
these issues.
There have been 14 final resteasy releases between 3.0.6.Final and
4.0.0.Final.
I would try getting a clean compile of just resteasy itself starting
with 3.1.0.Final,
then 3.5.0.Final, 3.6.0.Final and finally 4.0.0.Final. This should be
helpful
in identifying a maven version issue. You may also need to find a new
nexus repo
that contains the archive versions that appear to be missing or
corrupt. Make
updates in your maven settings.xml file. When experimenting with my
settings.xml
declarations I usually work from a copy of my settings file and build
the project
referencing the copy like this
mvn -s ./settings-experiment.xml clean install -DskipTests
Once you get a clean compile of 4.0.0.Final, then go back and try
building
within your working project.
On Thu, May 16, 2019 at 12:49 PM Max Magee <max.magee(a)singlewire.com> wrote:
Hi All,
I'm attempting to upgrade from an older version of resteasy-jaxb-provider
(3.0.6) to 4.0.0.Final due to some dependency conflicts on a larger project
that got resteasy-jackson2-provider, several com.fasterxml.jackson.core
dependency version bumps and jackson-databind version bumps for unrelated
reasons.
My question is about the maven packaging/pom configuration. I am using a
the maven-ant-tasks plugin from Apache (but I see the same issue/warning
messages resolving dependencies from maven central through the mvn command
line directly). The problem with the ant task may be three-fold: The
ant-maven task errors out when it can't read the poms (this is probably
mostly a *me/us *problem with our tooling). Secondly, it looks like some
of the pom configuration in the resteasy/jboss projects is possibly too
complicated for it or possibly even misconfigured (the errors I see in both
maven and ant tasks are related to not finding the parent-pom for the
project). Finally, the third issue I noticed may be a regression in maven
3.6.1 that causes it not to follow redirects.
That's a lot to parse, but let me break it down into pieces to see if
somebody may have an idea for a better way to resolve this issue.
1.) When upgrading to 4.0.0.Final (after fixing two or three differences
due to functionality changes, getting everything compiling), I am getting
the following errors when pulling it from the repo:
[artifact:dependencies] Downloading:
org/glassfish/jaxb/jaxb-runtime/2.3.1/jaxb-runtime-2.3.1.pom from
repository singlewire.public at
http://nexus.singlewire.lan:8081/nexus/content/groups/public/
[artifact:dependencies] Transferring 8K from singlewire.public
[artifact:dependencies] Downloading:
com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository
releases.java.net at http://maven.java.net/content/repositories/releases/
[artifact:dependencies] Transferring 0K from releases.java.net
[artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on
download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =
'<html>
[artifact:dependencies] <head><title>301' - RETRYING
[artifact:dependencies] Downloading:
com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository
releases.java.net at http://maven.java.net/content/repositories/releases/
[artifact:dependencies] Transferring 0K from releases.java.net
[artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on
download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =
'<html>
[artifact:dependencies] <head><title>301' - IGNORING
*[artifact:dependencies] An error has occurred while processing the Maven
artifact tasks.*
*[artifact:dependencies] Diagnosis:*
*[artifact:dependencies]*
*[artifact:dependencies] Unable to resolve artifact: Unable to get
dependency information: Unable to read the metadata file for artifact
'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent:
com.sun.xml.bind:jaxb-bom-ext for project:
com.sun.xml.bind.mvn:jaxb-parent:pom:null for project
com.sun.xml.bind.mvn:jaxb-parent:pom:null*
*[artifact:dependencies] org.glassfish.jaxb:jaxb-runtime:jar:2.3.1*
[artifact:dependencies]
[artifact:dependencies] from the specified remote repositories:
[artifact:dependencies] singlewire.mirror (
http://nexus:8081/nexus/content/groups/public/),
[artifact:dependencies] central (http://repo1.maven.org/maven2),
[artifact:dependencies] singlewire.public (
http://nexus.singlewire.lan:8081/nexus/content/groups/public/)
[artifact:dependencies]
[artifact:dependencies] Path to dependency:
[artifact:dependencies] 1) my.project:war:12.9.1-SNAPSHOT
[artifact:dependencies] 2)
org.jboss.resteasy:resteasy-jaxb-provider:jar:4.0.0.Final
2.) When I inspect the contents of the repo it's crashing on,
jaxb-bom-ext, this is the content of
~/.m2/repository/com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom:
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
3.) When I investigate our nexus repo and directly download the file, it
seems to contain the appropriate content, as does the repo at
maven.java.net:
https://maven.java.net/content/repositories/releases/com/sun/xml/bind/jax...
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="
http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd
">
<link type="text/css" id="dark-mode" rel="stylesheet"
href=""/>
<style type="text/css" id="dark-mode-custom-style"/>
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.glassfish.jaxb</groupId>
<artifactId>jaxb-bom</artifactId>
<relativePath>../bom/pom.xml</relativePath>
<version>2.3.1</version>
</parent>
<groupId>com.sun.xml.bind</groupId>
<artifactId>jaxb-bom-ext</artifactId>
<packaging>pom</packaging>
<name>JAXB BOM with ALL dependencies</name>
<description>
JAXB Bill of Materials (BOM) with all dependencies. If you are not sure -
DON'T USE THIS BOM. Use com.sun.xml.bind:jaxb-bom instead.
</description>
...
That description isn't super-reassuring, but I assume the packager knows
what s/he *is *sure. I noticed, too, that although our repo is trying to
grab the dependency from *http://*maven.java.net
Downloading: com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom
from repository releases.java.net at
http://maven.java.net/content/repositories/releases/
Visiting the actual site redirects to *https*, so that may be the initial
cause for the 301- mvn is downloading the 301 error page into the "pom"
location, which is really strange behavior. The only thing I found from
googling around for this issue is a decade-old bug report of this
happening in 2010 <https://issues.apache.org/jira/browse/MNG-4734> that
has long since been closed/fixed/merged. ¯\_(ツ)_/¯
When I visited the maven central repo and grabbed the
jaxb-bom-ext-2.3.1.pom then manually shoved it into my local m2 repo, I got
slightly further-
[artifact:dependencies] Unable to resolve artifact: Unable to get
dependency information: Unable to read the metadata file for artifact
'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent:
*org.glassfish.jaxb:jaxb-bom* for project:
com.sun.xml.bind:jaxb-bom-ext:pom:null for project
com.sun.xml.bind:jaxb-bom-ext:pom:null
[artifact:dependencies] org.glassfish.jaxb:jaxb-runtime:jar:2.3.1
My local m2 version of the pom for the jaxb-bom dependency looks like
this:
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.12.1</center>
</body>
</html>
When I do the same manual installation procedure for jaxb-bom as for
jaxb-bom-ext above, everything is happy:
[artifact:dependencies] Downloading:
org/glassfish/jaxb/txw2/2.3.1/txw2-2.3.1.pom from repository
singlewire.public at
http://nexus.singlewire.lan:8081/nexus/content/groups/public/
[artifact:dependencies] Transferring 4K from singlewire.public
[artifact:dependencies] Downloading:
org/glassfish/jaxb/txw2/2.3.1/txw2-2.3.1.jar from repository
singlewire.public at
http://nexus.singlewire.lan:8081/nexus/content/groups/public/
[artifact:dependencies] Transferring 69K from singlewire.public
I get two additional artifacts form jaxb and I'm off to the races.
Super strange behavior, but after struggling with this and our build tools
for a couple of days, I decided to just revert back from 4.0.0.Final to
3.0.6.Final, manually exclude and pull versions are compatible across those
versions (jackson-module-jaxb-annotations and jaxrs-api, specifically) some
conflicts and I have no issues pulling dependencies. I'd like to pull in
the latest dependencies, since I'm sure there are performance and security
tweaks here and there that would be nice to pick up, and it seems really
strange that maven's behavior is blocking this.
Any thoughts or theories?
--
Max Magee
_______________________________________________
resteasy-dev mailing list
resteasy-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/resteasy-dev
2:53 p.m.
Thanks for the response. First, excellent advice. I did jump right into
4.0.0.Final, and subsequently broke a bunch of things (even after working
around the nexus/maven issues). Most of them were minor and related to
CompletableFutures/asynchronously resolving responses and the way
ResteasyClientBuilder worked (including having to set auth headers on the
RestesyWebTarget instead of the client). After that, everything worked like
gangbusters except for my nexus issues, which are really, I think what the
question is about. I reverted the version bump not because it wasn't
compiling- it was- but because I couldn't get our CI tools to process the
pom/bom infrastructure, and therefore wasn't confident that all the kinks
were worked out with this version (it may just be an environment issue on
my end, we use a nexus sonatype repo in between to cache most of our deps
in house, but it seemed to pick up every change and its copies of the repos
looked pristine to me when I downloaded from our server).
The maven repo that I was pointed at seems to contain the correct data,
just under the https domain. I specified the repo I was trying to pull from
in my project's pom-
<repository>
<id>MAXs.java.net</id>
<name>java releases</name>
<url>https://maven.java.net/content/repositores/releases</url>
</repository>
I'm definitely not a maven maven- is there a difference between adding the
repo in my settings.xml and the project pom (in terms of this particular
project)? I tried it both ways (in pom and settings), and it worked for
both in the mvn dependency:resolve task but failed for both within the
ant-maven plugin. It seems that ant is just stupid about following 301
redirects when resolving complex dependencies.
And I saw console messages that indicated that maven tried there after
failing to validate the nexus cached copies against the error response
content.
[artifact:dependencies] Downloading:
org/glassfish/jaxb/jaxb-runtime/2.3.1/jaxb-runtime-2.3.1.pom from
repository nexus.public at
http://nexus.local.lan:8081/nexus/content/groups/public/
[artifact:dependencies] Transferring 8K from nexus.local
[artifact:dependencies] Downloading:
com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository
releases.java.net at http://maven.java.net/content/repositories/releases/
[artifact:dependencies] Transferring 0K from* releases.java.net
<http://releases.java.net>*
[artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on
download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =
'<html>
[artifact:dependencies] <head><title>301' - RETRYING
[artifact:dependencies] Downloading:
com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository
releases.java.net at http://maven.java.net/content/repositories/releases/
[artifact:dependencies] Transferring 0K from releases.java.net
[artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on
download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =
'<html>
[artifact:dependencies] <head><title>301' - IGNORING
[artifact:dependencies] An error has occurred while processing the Maven
artifact tasks.
[artifact:dependencies] Diagnosis:
[artifact:dependencies]
[artifact:dependencies] Unable to resolve artifact: Unable to get
dependency information: Unable to read the metadata file for artifact
'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent:
com.sun.xml.bind:jaxb-bom-ext for project:
com.sun.xml.bind.mvn:jaxb-parent:pom:null for project
com.sun.xml.bind.mvn:jaxb-parent:pom:null
[artifact:dependencies] org.glassfish.jaxb:jaxb-runtime:jar:2.3.1
[artifact:dependencies]
[artifact:dependencies] from the specified remote repositories:
[artifact:dependencies] nexus.mirror (
http://nexus:8081/nexus/content/groups/public/),
[artifact:dependencies] central (http://repo1.maven.org/maven2),
[artifact:dependencies] nexus.local (
http://nexus.local.lan:8081/nexus/content/groups/public/),
*[artifact:dependencies] MAXs.java.net <http://MAXs.java.net>
(https://maven.java.net/content/repositores/releases
<https://maven.java.net/content/repositores/releases>)*
--------
I don't really understand all the complexities of our build process, but
you're making me think I'm not insane, so that's something.
I think the problem may be with the maven-ant-tasks project that we're
relying on, rather than just the complexity of the pom/bom/parent
infrastructure (it's triggering the problems I'm having, but is probably
not THE problem).
<path id="maven-ant-tasks.classpath"
path="etc/buildhelper/maven-ant-tasks-2.1.3.jar" />
<typedef resource="org/apache/maven/artifact/ant/antlib.xml"
uri="antlib:org.apache.maven.artifact.ant"
classpathref="maven-ant-tasks.classpath" />
https://maven.apache.org/ant-tasks/
It doesn't make me happy to see this at the top of the page-
Maven Ant Tasks*Note: This component is retired. It is no longer
maintained.*
Thanks for your feedback, I appreciate it.
Max
On Thu, May 16, 2019 at 12:48 PM Rebecca Searls <rsearls(a)redhat.com> wrote:
As you have noted, you have quite a lot going on here.
* You've noted there may be a maven versioning issue.
* Some of the messages indicate some archives have been removed from some
of the repositories you are referencing or are corrupt.
* Moving from 3.0.6 to 4.0.0.Final is a big jump. I would not expect
this
to be an issue but it is.
I would suggest taking the following approach in identifying and addressing
these issues.
There have been 14 final resteasy releases between 3.0.6.Final and
4.0.0.Final.
I would try getting a clean compile of just resteasy itself starting
with 3.1.0.Final,
then 3.5.0.Final, 3.6.0.Final and finally 4.0.0.Final. This should be
helpful
in identifying a maven version issue. You may also need to find a new
nexus repo
that contains the archive versions that appear to be missing or
corrupt. Make
updates in your maven settings.xml file. When experimenting with my
settings.xml
declarations I usually work from a copy of my settings file and build
the project
referencing the copy like this
mvn -s ./settings-experiment.xml clean install -DskipTests
Once you get a clean compile of 4.0.0.Final, then go back and try
building
within your working project.
On Thu, May 16, 2019 at 12:49 PM Max Magee <max.magee(a)singlewire.com>
wrote:
> Hi All,
>
> I'm attempting to upgrade from an older version of resteasy-jaxb-provider
> (3.0.6) to 4.0.0.Final due to some dependency conflicts on a larger project
> that got resteasy-jackson2-provider, several com.fasterxml.jackson.core
> dependency version bumps and jackson-databind version bumps for unrelated
> reasons.
>
> My question is about the maven packaging/pom configuration. I am using a
> the maven-ant-tasks plugin from Apache (but I see the same issue/warning
> messages resolving dependencies from maven central through the mvn command
> line directly). The problem with the ant task may be three-fold: The
> ant-maven task errors out when it can't read the poms (this is probably
> mostly a *me/us *problem with our tooling). Secondly, it looks like some
> of the pom configuration in the resteasy/jboss projects is possibly too
> complicated for it or possibly even misconfigured (the errors I see in both
> maven and ant tasks are related to not finding the parent-pom for the
> project). Finally, the third issue I noticed may be a regression in maven
> 3.6.1 that causes it not to follow redirects.
>
> That's a lot to parse, but let me break it down into pieces to see if
> somebody may have an idea for a better way to resolve this issue.
>
> 1.) When upgrading to 4.0.0.Final (after fixing two or three differences
> due to functionality changes, getting everything compiling), I am getting
> the following errors when pulling it from the repo:
> [artifact:dependencies] Downloading:
> org/glassfish/jaxb/jaxb-runtime/2.3.1/jaxb-runtime-2.3.1.pom from
> repository singlewire.public at
> http://nexus.singlewire.lan:8081/nexus/content/groups/public/
> [artifact:dependencies] Transferring 8K from singlewire.public
> [artifact:dependencies] Downloading:
> com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository
> releases.java.net at http://maven.java.net/content/repositories/releases/
> [artifact:dependencies] Transferring 0K from releases.java.net
> [artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed
> on download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =
> '<html>
> [artifact:dependencies] <head><title>301' - RETRYING
> [artifact:dependencies] Downloading:
> com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository
> releases.java.net at http://maven.java.net/content/repositories/releases/
> [artifact:dependencies] Transferring 0K from releases.java.net
> [artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed
> on download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =
> '<html>
> [artifact:dependencies] <head><title>301' - IGNORING
> *[artifact:dependencies] An error has occurred while processing the Maven
> artifact tasks.*
> *[artifact:dependencies] Diagnosis:*
> *[artifact:dependencies]*
> *[artifact:dependencies] Unable to resolve artifact: Unable to get
> dependency information: Unable to read the metadata file for artifact
> 'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent:
> com.sun.xml.bind:jaxb-bom-ext for project:
> com.sun.xml.bind.mvn:jaxb-parent:pom:null for project
> com.sun.xml.bind.mvn:jaxb-parent:pom:null*
> *[artifact:dependencies] org.glassfish.jaxb:jaxb-runtime:jar:2.3.1*
> [artifact:dependencies]
> [artifact:dependencies] from the specified remote repositories:
> [artifact:dependencies] singlewire.mirror (
> http://nexus:8081/nexus/content/groups/public/),
> [artifact:dependencies] central (http://repo1.maven.org/maven2),
> [artifact:dependencies] singlewire.public (
> http://nexus.singlewire.lan:8081/nexus/content/groups/public/)
> [artifact:dependencies]
> [artifact:dependencies] Path to dependency:
> [artifact:dependencies] 1) my.project:war:12.9.1-SNAPSHOT
> [artifact:dependencies] 2)
> org.jboss.resteasy:resteasy-jaxb-provider:jar:4.0.0.Final
>
> 2.) When I inspect the contents of the repo it's crashing on,
> jaxb-bom-ext, this is the content of
> ~/.m2/repository/com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom:
> <html>
> <head><title>301 Moved Permanently</title></head>
> <body bgcolor="white">
> <center><h1>301 Moved Permanently</h1></center>
> <hr><center>nginx/1.12.1</center>
> </body>
> </html>
>
> 3.) When I investigate our nexus repo and directly download the file, it
> seems to contain the appropriate content, as does the repo at
> maven.java.net:
>
>
https://maven.java.net/content/repositories/releases/com/sun/xml/bind/jax...
> <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="
> http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="
> http://maven.apache.org/POM/4.0.0
> http://maven.apache.org/maven-v4_0_0.xsd">
> <link type="text/css" id="dark-mode"
rel="stylesheet" href=""/>
> <style type="text/css" id="dark-mode-custom-style"/>
> <modelVersion>4.0.0</modelVersion>
> <parent>
> <groupId>org.glassfish.jaxb</groupId>
> <artifactId>jaxb-bom</artifactId>
> <relativePath>../bom/pom.xml</relativePath>
> <version>2.3.1</version>
> </parent>
> <groupId>com.sun.xml.bind</groupId>
> <artifactId>jaxb-bom-ext</artifactId>
> <packaging>pom</packaging>
> <name>JAXB BOM with ALL dependencies</name>
> <description>
> JAXB Bill of Materials (BOM) with all dependencies. If you are not sure -
> DON'T USE THIS BOM. Use com.sun.xml.bind:jaxb-bom instead.
> </description>
> ...
> That description isn't super-reassuring, but I assume the packager knows
> what s/he *is *sure. I noticed, too, that although our repo is trying to
> grab the dependency from *http://*maven.java.net
> Downloading: com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom
> from repository releases.java.net at
> http://maven.java.net/content/repositories/releases/
> Visiting the actual site redirects to *https*, so that may be the
> initial cause for the 301- mvn is downloading the 301 error page into the
> "pom" location, which is really strange behavior. The only thing I found
> from googling around for this issue is a decade-old bug report of this
> happening in 2010 <https://issues.apache.org/jira/browse/MNG-4734> that
> has long since been closed/fixed/merged. ¯\_(ツ)_/¯
>
> When I visited the maven central repo and grabbed the
> jaxb-bom-ext-2.3.1.pom then manually shoved it into my local m2 repo, I got
> slightly further-
> [artifact:dependencies] Unable to resolve artifact: Unable to get
> dependency information: Unable to read the metadata file for artifact
> 'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent:
> *org.glassfish.jaxb:jaxb-bom* for project:
> com.sun.xml.bind:jaxb-bom-ext:pom:null for project
> com.sun.xml.bind:jaxb-bom-ext:pom:null
> [artifact:dependencies] org.glassfish.jaxb:jaxb-runtime:jar:2.3.1
>
> My local m2 version of the pom for the jaxb-bom dependency looks like
> this:
> <html>
> <head><title>301 Moved Permanently</title></head>
> <body bgcolor="white">
> <center><h1>301 Moved Permanently</h1></center>
> <hr><center>nginx/1.12.1</center>
> </body>
> </html>
>
> When I do the same manual installation procedure for jaxb-bom as for
> jaxb-bom-ext above, everything is happy:
> [artifact:dependencies] Downloading:
> org/glassfish/jaxb/txw2/2.3.1/txw2-2.3.1.pom from repository
> singlewire.public at
> http://nexus.singlewire.lan:8081/nexus/content/groups/public/
> [artifact:dependencies] Transferring 4K from singlewire.public
> [artifact:dependencies] Downloading:
> org/glassfish/jaxb/txw2/2.3.1/txw2-2.3.1.jar from repository
> singlewire.public at
> http://nexus.singlewire.lan:8081/nexus/content/groups/public/
> [artifact:dependencies] Transferring 69K from singlewire.public
> I get two additional artifacts form jaxb and I'm off to the races.
>
> Super strange behavior, but after struggling with this and our build
> tools for a couple of days, I decided to just revert back from 4.0.0.Final
> to 3.0.6.Final, manually exclude and pull versions are compatible across
> those versions (jackson-module-jaxb-annotations and jaxrs-api,
> specifically) some conflicts and I have no issues pulling dependencies. I'd
> like to pull in the latest dependencies, since I'm sure there are
> performance and security tweaks here and there that would be nice to pick
> up, and it seems really strange that maven's behavior is blocking this.
>
> Any thoughts or theories?
> --
> Max Magee
> _______________________________________________
> resteasy-dev mailing list
> resteasy-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/resteasy-dev
>
--
Max Magee
Software Engineer
(608) 661-1166 | max.magee(a)singlewire.com
[image: Singlewire-Logo-Sigstr.png] <http://www.singlewire.com>
www.singlewire.com | Twitter <https://twitter.com/singlewire> | Facebook
<https://www.facebook.com/Singlewire> | LinkedIn
<https://www.linkedin.com/company/singlewire-software>
*Keeping people safe and informed. Everywhere, every time.*
[image: Singlewire Software Blarg] <https://goo.gl/zVT3HX>
<http://sigstr.singlewire.com/uc/579ba7385df06473474f1a5e/watermark>
2027
days inactive
2027
days old
2 comments
2 participants
participants (2)
-
Max Magee -
Rebecca Searls