Maven dependency not getting corresponding POM file downloaded

Question

I've got a maven project that has a dependency that it gets from a remote Nexus repository. I believe that the dependency was not built with maven, and just uploaded with a barebones POM file. The layout on the server looks fine though, so it was probably deployed with maven.

When maven downloads the dependency to my local repository, it downloads the jar file, but doesn't get the POM. At build time, there's a warning that the POM couldn't be found, and no dependency information available. I'm not actually using any of its code directly (it's actually a transitive dependency), so build completes successfully.

The real problem arises when I try to perform site generation for my project. The part that tries to generate the dependency graph report fails, because it can't find the POM for this dependency to work with.

I can't figure out why I'm not getting the POM downloaded, when the jar file for it gets downloaded just fine.

The POM file for that particular dependency looks like this (you can see why I don't think it's built with maven :))

<project>
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.company.component</groupId>
    <artifactId>my-artifact</artifactId>
    <version>1.0.1</version>
</project>

You'll notice that the root <project> element doesn't contain any namespace or schema information. Could this be related? Could it be Nexus not recognizing it as a POM? Apart from the possibility of some small syntactical character missing or mistaken, this is my current train of thought...please don't let it influence any ideas you may have! :)

Also, while troubleshooting, I've pasted the contents of the remote POM file into the correct file location in my local .m2 repo. Everything works fine when I do that. This isn't an acceptable fix though, because we will need the build to be done on our CI build servers.

Any help/suggestions greatly appreciated!

Edit:

I've managed to temporarily solve my actual problem, but the strangeness here still exists. I solved the problem by explicitly excluding the thing that depends on this from the dependency that's in my pom (the trouble dep is two steps away at least, and I'm not using anything that uses the thing that pulls it in):

<dependency>
    <groupId>com.company.utility</groupId>
    <artifactId>shared-utility</artifactId>
    <version>1.2.3</version>

    <exclusions>
        <exclusion>
            <groupId>com.company.common.component</groupId>
            <artifactId>thing-that-puls-in-bad-artifact</artifactId>
        </exclusion>
    </exclusions>
</dependency>

I've created a dummy project to prove it, with the following POM:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>com.company.project</groupId>
    <artifactId>my-project</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <dependencies>
        <dependency>
            <groupId>com.company.component</groupId>
            <artifactId>bad-artifact</artifactId>
            <version>1.0.1</version>
        </dependency>
    </dependencies>
</project>

Now in ~/.m2/repository/com/company/compnent/bad-artifact/1.0.1/, I've got:

_remote.repositories
bad-artifact-1.0.1.jar
bad-artifact-1.0.1.jar.sha1
bad-artifact-1.0.1.pom.lastUpdated

With no actual POM file.

Solution 1

If you look inside of _remote.repositories, then this file probably contains information which says "downloading the POM failed last time, don't try it again."

That's one of the things where Maven's policy "don't try to download releases again" gets in your way. Try to delete the folder ~/.m2/repository/com/company/compnent/bad-artifact/1.0.1/ and run Maven again to see the error.

It's quite possible that Maven refuses to use such a broken POM since the root element doesn't have the correct XML namespace. But it's hard to tell without seeing the actual error message.

A way to fix this is to download the JAR and to use mvn install:install-file from the command line to install the dependency locally. Even better, you can use mvn deploy:deploy-file to deploy it to your own Nexus server so all other developers now get a "good" version of the POM.

You should also get in contact with the people running the remote Nexus server so they can fix the issue.

Solution 2

Not related to your actual problem, but with maven (at least, recent version), generated jar contains their pom.xml in the META-INF/maven folder of that jar.

You should try to run maven with -e -X, and move your local repository to force Maven to download all, again.

mv "~/.m2/repository" "~/.m2/repository.old"
mvn -X -e dependency:tree

[edit] it was initially a comment, but it will be too long:

As far as I understand your problem, I think it is an error on Nexus, and not on your machine. Any valid solution would require you to mess with that your company Nexus. If you don't have permissions to do anything with your Company Nexus, you can test it with a local Nexus.

You can also enforce use of that Nexus in your ~/.m2/settings.xml like this:

<mirrors>
    <mirror>
      <id>nexus-local-central</id>
      <mirrorOf>central</mirrorOf>
      <url>http://localhost:8081/nexus/content/repositories/central</url>
    </mirror>
    <mirror>
      <id>nexus-local-any</id>
      <mirrorOf>external:*</mirrorOf>
      <url>http://localhost:8081/nexus/content/groups/public</url>
    </mirror>
</mirrors>

You should not lose too much time as to why it fails, but focus on making it working.

For that, I think you should write a valid pom.xml for that artifact, and redeploy it on the server using the pomFile option:

mvn deploy:deploy-file -DpomFile=valid-pom.xml -Dfile=foobar.jar -Durl=http://nexus:8081 -DrepositoryId=company-nexus-deploy

Or if you are too lazy (or if this command fail), do it from the Nexus GUI!

PS: the Nexus default admin login/password are admin/admin123, and I think there was also deploy/deploy123 for deployment. Most Nexus that I've seen were not configured to use another login/password.

Comments

[grdryn]

Thanks for your feedback. You've helped me to prove that the jar wasn't build with maven at least: no META-INF/maven folder inside it.

[grdryn]

I've been removing the bad-artifact dependency folder from ~/.m2/repository/ regularly while trying to troubleshoot. Even removing it now and running mvn -X -e dependency:tree runs successfully and pulls down the jar again (but again, not the POM).

[grdryn]

Thanks for the feedback Aaron. However, the _remote.repositories file doesn't contain any errors. I've also been deleting ~/.m2/repository/com/company/compnent/bad-artifact/1.0.1/ regularly while troubleshooting. When I copy the pom verbatim from nexus into my local repo, then it works fine, so I don't think it's maven that's refusing to use it (although maybe Nexus refusing to serve it as a POM? I don't know how that works internally). I'll be contacting the Nexus admins later, hopefully they can sort it out. Thanks. :)

[Aaron Digulla]

@GerardRyan: What about the bad-artifact-1.0.1.pom.lastUpdated file? What's in there?

[grdryn]

I thought I previously saw some error output there, but currently it's just: #NOTE: This is an Aether internal implementation file, its format can be changed without prior notice. #Thu Sep 04 14:12:29 IST 2014 http\://nexus.company.com\:8081/nexus/content/groups/company‌​/.error= http\://nexus.company.com\:8081/nexus/content/groups/company‌​/.lastUpdated=140983‌​6349510

[Aaron Digulla]

Delete that one as well and see if Maven tries to download the POM again

[grdryn]

I've deleted that entire folder several times, and the same result every time. If I get a chance soon, I think I'll try to make two dummy projects, and see if I can isolate the problem to missing namespace/schema info in <project> element...or at least rule that out :)

[Aaron Digulla]

You should really see an error in the Maven output (or at least a warning) after deleting the folder.