[Artifactory-users] Aggregation aggrevation!!

[Jason P. <jpr...@qp...>]

I've recently noticed (though it's been there all along) that using a
single artifactory instance to mirror both released and snapshot remote
repositories results in grabbing snapshots of plugins when you allow
automatic version identification to occur for plugins.  Although we
should (and most likely will) change to specific plugin versions in our
pom's, I found the behavior surprising, because it's a side-effect of
the remote repository aggregation.
=20
For example, we have this right now:
- 1 instance of artifactory hosting a few internal repositories and
mirroring a few external repositories (repo1, codehaus, etc).
- a shared settings.xml (installed w/maven overriding base
maven/conf/settings.xml) that has entries to override 'central'
- no repository definitions in the pom's
=20
    <profile>
      <id>artifactory</id>
      <repositories>
        <repository>
          <id>central</id>
          <url>http://repo.dev:8081/artifactory/repo</url>
          <snapshots>
              <enabled>false</enabled>
          </snapshots>
        </repository>
        <repository>
          <id>snapshots</id>
          <url>http://repo.dev:8081/artifactory/repo</url>
          <releases>
              <enabled>false</enabled>
          </releases>
        </repository>
      </repositories>
      <pluginRepositories>
        <pluginRepository>
          <id>central</id>
          <url>http://repo.dev:8081/artifactory/repo</url>
          <snapshots>
            <enabled>false</enabled>
          </snapshots>
        </pluginRepository>
        <pluginRepository>
          <id>snapshots</id>
          <url>http://repo.dev:8081/artifactory/repo</url>
          <releases>
            <enabled>false</enabled>
          </releases>
        </pluginRepository>
      </pluginRepositories>
    </profile>

=20
If I do a simple build with this pom using the settings above, I resolve
'maven-resources-plugin' to 2.2
If I disable the profile so artifactory isn't overriding central, then
'maven-resources-plugin' resolves to version 2.3-SNAPSHOT
=20
Searching through the cached repositories, the snapshot version is
coming in from apache-snapshots, even though repo1 is "earlier" in the
repository definition.
=20
I would have expected Artifactory to search the remote caches
sequentially, and stop at the first match (which would be version 2.2 in
repo1).  However, it's obviously determining that the snapshot from
apache-snapshots is newer, so it's returning that instead.
=20
Is there any way to limit the remote repos searched by artifactory?  I
guess one option would be to have different instances of artifactory,
and only host release repositories on one and snapshots on the other,
and change settings.xml to refer to each appropriately (though it seems
changing the binding URL is a bit of a hassle, so I guess it would have
to be limited to running on different ports???).
=20
However, I'd prefer to not have to run two instances.
=20
Other ideas?
=20
I like the fact that repositories only have to be defined in artifactory
now (good for a corporate environment) rather than in a bunch of project
poms etc.

Jason Pringle
Senior Software Architect
Qpass - Amdocs Digital Commerce Division
2211 Elliott Ave | Suite 400 | Seattle, WA 98121
o: 206.405.3173 | m: 206.601.7183 | jpr...@qp...
<mailto:jpr...@qp...> =20

=20