[resteasy-dev] Pom/Bom dependency issue

Thu May 16 13:48:47 EDT 2019

As you have noted, you have quite a lot going on here.
  * You've noted there may be a maven versioning issue.
  * Some of the messages indicate some archives have been removed from some
    of the repositories you are referencing or are corrupt.
  * Moving from 3.0.6 to 4.0.0.Final is a big jump.  I would not expect this
    to be an issue but it is.

I would suggest taking the following approach in identifying and addressing
these issues.
    There have been 14 final resteasy releases between 3.0.6.Final and
4.0.0.Final.
    I would try getting a clean compile of just resteasy itself starting
with 3.1.0.Final,
    then 3.5.0.Final, 3.6.0.Final and finally 4.0.0.Final.  This should be
helpful
    in identifying a maven version issue.  You may also need to find a new
nexus repo
    that contains the archive versions that appear to be missing or
corrupt.  Make
    updates in your maven settings.xml file.  When experimenting with my
settings.xml
    declarations I usually work from a copy of my settings file and build
the project
    referencing the copy like this
        mvn -s ./settings-experiment.xml  clean install -DskipTests

    Once you get a clean compile of 4.0.0.Final, then go back and try
building
    within your working project.

On Thu, May 16, 2019 at 12:49 PM Max Magee <max.magee at singlewire.com> wrote:

> Hi All,
>
> I'm attempting to upgrade from an older version of resteasy-jaxb-provider
> (3.0.6) to 4.0.0.Final due to some dependency conflicts on a larger project
> that got resteasy-jackson2-provider, several com.fasterxml.jackson.core
> dependency version bumps and jackson-databind version bumps for unrelated
> reasons.
>
> My question is about the maven packaging/pom configuration. I am using a
> the maven-ant-tasks plugin from Apache (but I see the same issue/warning
> messages resolving dependencies from maven central through the mvn command
> line directly). The problem with the ant task may be three-fold: The
> ant-maven task errors out when it can't read the poms (this is probably
> mostly a *me/us *problem with our tooling). Secondly, it looks like some
> of the pom configuration in the resteasy/jboss projects is possibly too
> complicated for it or possibly even misconfigured (the errors I see in both
> maven and ant tasks are related to not finding the parent-pom for the
> project). Finally, the third issue I noticed may be a regression in maven
> 3.6.1 that causes it not to follow redirects.
>
> That's a lot to parse, but let me break it down into pieces to see if
> somebody may have an idea for a better way to resolve this issue.
>
> 1.) When upgrading to 4.0.0.Final (after fixing two or three differences
> due to functionality changes, getting everything compiling), I am getting
> the following errors when pulling it from the repo:
> [artifact:dependencies] Downloading:
> org/glassfish/jaxb/jaxb-runtime/2.3.1/jaxb-runtime-2.3.1.pom from
> repository singlewire.public at
> http://nexus.singlewire.lan:8081/nexus/content/groups/public/
> [artifact:dependencies] Transferring 8K from singlewire.public
> [artifact:dependencies] Downloading:
> com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository
> releases.java.net at http://maven.java.net/content/repositories/releases/
> [artifact:dependencies] Transferring 0K from releases.java.net
> [artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on
> download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =
> '<html>
> [artifact:dependencies] <head><title>301' - RETRYING
> [artifact:dependencies] Downloading:
> com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom from repository
> releases.java.net at http://maven.java.net/content/repositories/releases/
> [artifact:dependencies] Transferring 0K from releases.java.net
> [artifact:dependencies] [WARNING] *** CHECKSUM FAILED - Checksum failed on
> download: local = '073af964da9bb8a3b83c9c9dfc3568f1e12a9479'; remote =
> '<html>
> [artifact:dependencies] <head><title>301' - IGNORING
> *[artifact:dependencies] An error has occurred while processing the Maven
> artifact tasks.*
> *[artifact:dependencies]  Diagnosis:*
> *[artifact:dependencies]*
> *[artifact:dependencies] Unable to resolve artifact: Unable to get
> dependency information: Unable to read the metadata file for artifact
> 'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent:
> com.sun.xml.bind:jaxb-bom-ext for project:
> com.sun.xml.bind.mvn:jaxb-parent:pom:null for project
> com.sun.xml.bind.mvn:jaxb-parent:pom:null*
> *[artifact:dependencies]   org.glassfish.jaxb:jaxb-runtime:jar:2.3.1*
> [artifact:dependencies]
> [artifact:dependencies] from the specified remote repositories:
> [artifact:dependencies]   singlewire.mirror (
> http://nexus:8081/nexus/content/groups/public/),
> [artifact:dependencies]   central (http://repo1.maven.org/maven2),
> [artifact:dependencies]   singlewire.public (
> http://nexus.singlewire.lan:8081/nexus/content/groups/public/)
> [artifact:dependencies]
> [artifact:dependencies] Path to dependency:
> [artifact:dependencies] 1) my.project:war:12.9.1-SNAPSHOT
> [artifact:dependencies] 2)
> org.jboss.resteasy:resteasy-jaxb-provider:jar:4.0.0.Final
>
> 2.) When I inspect the contents of the repo it's crashing on,
> jaxb-bom-ext, this is the content of
> ~/.m2/repository/com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom:
> <html>
> <head><title>301 Moved Permanently</title></head>
> <body bgcolor="white">
> <center><h1>301 Moved Permanently</h1></center>
> <hr><center>nginx/1.12.1</center>
> </body>
> </html>
>
> 3.) When I investigate our nexus repo and directly download the file, it
> seems to contain the appropriate content, as does the repo at
> maven.java.net:
>
> https://maven.java.net/content/repositories/releases/com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom
> <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="
> http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="
> http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd
> ">
> <link type="text/css" id="dark-mode" rel="stylesheet" href=""/>
> <style type="text/css" id="dark-mode-custom-style"/>
> <modelVersion>4.0.0</modelVersion>
> <parent>
> <groupId>org.glassfish.jaxb</groupId>
> <artifactId>jaxb-bom</artifactId>
> <relativePath>../bom/pom.xml</relativePath>
> <version>2.3.1</version>
> </parent>
> <groupId>com.sun.xml.bind</groupId>
> <artifactId>jaxb-bom-ext</artifactId>
> <packaging>pom</packaging>
> <name>JAXB BOM with ALL dependencies</name>
> <description>
> JAXB Bill of Materials (BOM) with all dependencies. If you are not sure -
> DON'T USE THIS BOM. Use com.sun.xml.bind:jaxb-bom instead.
> </description>
> ...
> That description isn't super-reassuring, but I assume the packager knows
> what s/he *is *sure. I noticed, too, that although our repo is trying to
> grab the dependency from *http://*maven.java.net
>  Downloading: com/sun/xml/bind/jaxb-bom-ext/2.3.1/jaxb-bom-ext-2.3.1.pom
> from repository releases.java.net at
> http://maven.java.net/content/repositories/releases/
> Visiting the actual site redirects to *https*, so that may be the initial
> cause for the 301- mvn is downloading the 301 error page into the "pom"
> location, which is really strange behavior. The only thing I found from
> googling around for this issue is a decade-old bug report of this
> happening in 2010 <https://issues.apache.org/jira/browse/MNG-4734> that
> has long since been closed/fixed/merged. ¯\_(ツ)_/¯
>
> When I visited the maven central repo and grabbed the
> jaxb-bom-ext-2.3.1.pom then manually shoved it into my local m2 repo, I got
> slightly further-
> [artifact:dependencies] Unable to resolve artifact: Unable to get
> dependency information: Unable to read the metadata file for artifact
> 'org.glassfish.jaxb:jaxb-runtime:jar': Cannot find parent:
> *org.glassfish.jaxb:jaxb-bom* for project:
> com.sun.xml.bind:jaxb-bom-ext:pom:null for project
> com.sun.xml.bind:jaxb-bom-ext:pom:null
> [artifact:dependencies]   org.glassfish.jaxb:jaxb-runtime:jar:2.3.1
>
>  My local m2 version of the pom for the jaxb-bom dependency looks like
> this:
> <html>
> <head><title>301 Moved Permanently</title></head>
> <body bgcolor="white">
> <center><h1>301 Moved Permanently</h1></center>
> <hr><center>nginx/1.12.1</center>
> </body>
> </html>
>
> When I do the same manual installation procedure for jaxb-bom as for
> jaxb-bom-ext above, everything is happy:
> [artifact:dependencies] Downloading:
> org/glassfish/jaxb/txw2/2.3.1/txw2-2.3.1.pom from repository
> singlewire.public at
> http://nexus.singlewire.lan:8081/nexus/content/groups/public/
> [artifact:dependencies] Transferring 4K from singlewire.public
> [artifact:dependencies] Downloading:
> org/glassfish/jaxb/txw2/2.3.1/txw2-2.3.1.jar from repository
> singlewire.public at
> http://nexus.singlewire.lan:8081/nexus/content/groups/public/
> [artifact:dependencies] Transferring 69K from singlewire.public
> I get two additional artifacts form jaxb and I'm off to the races.
>
> Super strange behavior, but after struggling with this and our build tools
> for a couple of days, I decided to just revert back from 4.0.0.Final to
> 3.0.6.Final, manually exclude and pull versions are compatible across those
> versions (jackson-module-jaxb-annotations and jaxrs-api, specifically) some
> conflicts and I have no issues pulling dependencies. I'd like to pull in
> the latest dependencies, since I'm sure there are performance and security
> tweaks here and there that would be nice to pick up, and it seems really
> strange that maven's behavior is blocking this.
>
> Any thoughts or theories?
> --
> Max Magee
> _______________________________________________
> resteasy-dev mailing list
> resteasy-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/resteasy-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/resteasy-dev/attachments/20190516/4d9f9d51/attachment-0001.html 