Maven dependency:get 从 settings.xml 获取最新的忽略存储库

Question

我正在尝试从我的远程存储库（Artifactory）下载最新的快照版本。为此，我正在使用以下命令：

mvn dependency:get \
  -Dartifact=com.acme:my-application:LATEST:war \
  -DremoteRepositories=http://localhost:8085/artifactory/libs-snapshots-local/

libs-snapshot-local 存储库是 Artifactory 的一部分，所有快照都存储在其中。如果我在以下路径打开 maven-metadata.xml 文件：

http://localhost:8085/artifactory/libs-snapshots-local/com/acme/my-application/maven-metadata.xml

然后我得到以下 XML 响应：

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>com.acme</groupId>
  <artifactId>my-application</artifactId>
  <version>2.0.0-20160222.105839-1</version>
  <versioning>
    <latest>2.0.0-SNAPSHOT</latest>
    <versions>
      <version>2.0.0-SNAPSHOT</version>
    </versions>
    <lastUpdated>20160223132257</lastUpdated>
  </versioning>
</metadata>

因此，根据此文件，WAR 版本为 2.0.0-SNAPSHOT 的应该是被检索到的。

然而，当我执行命令时，我得到以下响应：

[INFO] Scanning for projects...
[INFO]                                                                         
[INFO] ------------------------------------------------------------------------
[INFO] Building Maven Stub Project (No POM) 1
[INFO] ------------------------------------------------------------------------
[INFO] 
[INFO] --- maven-dependency-plugin:2.8:get (default-cli) @ standalone-pom ---
[INFO] Resolving com.acme:my-application:war:LATEST with transitive dependencies
Downloading: http://download.java.net/maven/2/com/acme/my-application/maven-metadata.xml
Downloading: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/maven-metadata.xml
Downloading: http://repo1.maven.org/maven2/com/acme/my-application/maven-metadata.xml
Downloading: http://localhost:8085/artifactory/libs-snapshots/com/acme/my-application/maven-metadata.xml
Downloading: http://localhost:8085/artifactory/libs-snapshots-local/com/acme/my-application/maven-metadata.xml
Downloaded: http://localhost:8085/artifactory/libs-snapshots-local/com/acme/my-application/maven-metadata.xml (378 B at 23.1 KB/sec)
Downloaded: http://localhost:8085/artifactory/libs-snapshots/com/acme/my-application/maven-metadata.xml (378 B at 0.5 KB/sec)
Downloaded: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/maven-metadata.xml (898 B at 0.6 KB/sec)
Downloading: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/1.0.0/my-application-1.0.0.pom
Downloaded: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/1.0.0/my-application-1.0.0.pom (26 KB at 1475.0 KB/sec)
Downloading: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/1.0.0/my-application-1.0.0.war
Downloaded: http://localhost:8085/artifactory/libs-releases/com/acme/my-application/1.0.0/my-application-1.0.0.war (77415 KB at 9657.4 KB/sec)

看起来 dependency:get 目标试图通过查看我的 settings.xml 文件和 -DremoteRepositories 参数中的所有存储库来下载工件。

因此，它也在查看我的版本存储库，其中包含一个版本 1.0.0，该版本的上传时间晚于 2.2.0-SNAPSHOT。

我的 settings.xml 文件如下所示：

<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
                      http://maven.apache.org/xsd/settings-1.0.0.xsd">

    <pluginGroups>
        <pluginGroup>org.mortbay.jetty</pluginGroup>
    </pluginGroups>
    <profiles>
        <profile>
            <repositories>
                <repository>
                    <snapshots>
                        <enabled>false</enabled>
                    </snapshots>
                    <id>central</id>
                    <name>libs-releases</name>
                    <url>http://localhost:8085/artifactory/libs-releases</url>
                </repository>
                <repository>
                    <snapshots />
                    <id>snapshots</id>
                    <name>libs-snapshots</name>
                    <url>http://localhost:8085/artifactory/libs-snapshots</url>
                </repository>
                <repository>
                    <id>Maven</id>
                    <name>Maven Repository</name>
                    <url>http://repo1.maven.org/maven2/</url>
                </repository>
                <repository>
                    <id>Java</id>
                    <name>Java Repository</name>
                    <url>http://download.java.net/maven/2/</url>
                </repository>
            </repositories>
            <id>artifactory</id>
        </profile>
    </profiles>
    <activeProfiles>
        <activeProfile>artifactory</activeProfile>
    </activeProfiles>
</settings>

有没有办法告诉 maven-dependency-plugin 不要使用 settings.xml 中定义的存储库，而只使用命令中给出的依赖项？

Answer 1

Reading the source code, what you are describing is exactly the behaviour of the dependency:get 目标。它将添加到命令行上指定的 remoteRepositories，当前活动存储库的列表。

将代码复制到这里以供参考：

if ( pomRemoteRepositories != null )
{
    repoList.addAll( pomRemoteRepositories );
}

可以看到 repoList 变量（稍后用于要检查的存储库列表）将始终包含活动存储库，目前没有办法解决这个问题。

活动存储库列表 is retrieved 具有：

@Parameter( defaultValue = "${project.remoteArtifactRepositories}", readonly = true, required = true )
private List<ArtifactRepository> pomRemoteRepositories;

这也意味着不能在命令行中覆盖它（它是只读的并且没有用户属性）。

所以在你的情况下，它会导致你在 artifactory 配置文件下定义的所有存储库也被使用，因为它被声明为活动的。

我能看到的唯一可能的解决方法是 invoke Maven with a default settings.xml file (the one in the Maven installation for example). Or create a feature request at their Jira 询问这个用例（我找不到与此相关的任何内容）。

Maven dependency:get 从 settings.xml 获取最新的忽略存储库

Maven dependency:get get LATEST ignore repositories from settings.xml

java

maven

artifactory

maven-dependency-plugin