You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@logging.apache.org by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2025/05/19 14:21:26 UTC
[PR] Replace Maven Cache with Mimír [logging-parent]
ppkarwasz opened a new pull request, #389:
URL: https://github.com/apache/logging-parent/pull/389
This pull request replaces the use of the Maven local repository cache with [Mimír](https://maveniverse.eu/docs/mimir/), a specialized, immutable cache for remote Maven repositories.
### Description
The Maven local repository serves multiple purposes:
- Mirrors immutable releases from Maven Central
- Caches snapshot artifacts
- Acts as a local staging area for builds
Because of these overlapping responsibilities, the local repository often becomes polluted with temporary artifacts, making it unreliable for consistent, reproducible builds. Additionally, it is not safe to share across workflows.
One major issue caused by sharing the local Maven repository is the occurrence of false negatives in the `verify-reproducibility-reusable` check (see #388).
### Benefits of Using Mimír
Mimír provides a cleaner and more reliable caching approach:
- **Immutable by design**: Only caches artifacts from remote Maven repositories, which do not change.
- **Workflow-friendly**: Enables a single shared cache across workflows without risk of contamination from snapshots or local artifacts.
This change improves build reproducibility, reduces cache-related issues, and simplifies cache management.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace Maven Cache with Mimír [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #389:
URL: https://github.com/apache/logging-parent/pull/389#issuecomment-2936742188
I forgot to mention that I deployed the same solution in [`sbom-enforcer/sbom-enforcer`](https://github.com/sbom-enforcer/sbom-enforcer) a couple of weeks ago and it seems to work correctly so far.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace Maven Cache with Mimír [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on PR #389:
URL: https://github.com/apache/logging-parent/pull/389#issuecomment-2957915709
> single reliable cache **without** locally built artifacts that can be reused in all workflows.
Doesn't #406 deliver this?
> In the meantime I created #406 that uses a separate cache for the `verify-reproducibility` workflow.
Thanks so much for your understanding and kind effort – approved.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace Maven Cache with Mimír [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #389:
URL: https://github.com/apache/logging-parent/pull/389#issuecomment-2891382212
I am marking this as draft, since there are still some details of `actions/cache` I need to work on. The ultimate goal is to have a single cache that is updated when new dependency version arrive.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace Maven Cache with Mimír [logging-parent]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #389:
URL: https://github.com/apache/logging-parent/pull/389#discussion_r2096140617
##########
pom.xml:
##########
@@ -362,6 +363,12 @@
<version>${maven-artifact-plugin.version}</version>
</plugin>
+ <plugin>
Review Comment:
The Mimír plugin is defined twice in this pom.xml file with different configurations (one with a version and one with <extensions>true</extensions>). If both entries serve the same purpose, consider consolidating them to reduce redundancy and to simplify maintenance.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace Maven Cache with Mimír [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #389:
URL: https://github.com/apache/logging-parent/pull/389#issuecomment-2951942239
In the long run I would prefer to use a solution like Mimír to ensure that we only have a single reliable cache **without** locally built artifacts that can be reused in all workflows.
In the meantime I created #406 that uses a separate cache for the `verify-reproducibility` workflow.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace Maven Cache with Mimír [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on code in PR #389:
URL: https://github.com/apache/logging-parent/pull/389#discussion_r3699953577
##########
pom.xml:
##########
@@ -956,6 +963,16 @@
</executions>
</plugin>
+ <!--
+ ~ Use Mimir as Maven cache:
+ ~ See: https://maveniverse.eu/docs/mimir/
+ -->
+ <plugin>
+ <groupId>eu.maveniverse.maven.mimir</groupId>
+ <artifactId>extension</artifactId>
+ <extensions>true</extensions>
+ </plugin>
Review Comment:
Does this mean Mimir will be used everywhere, not just CI?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace Maven Cache with Mimír [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #389:
URL: https://github.com/apache/logging-parent/pull/389#discussion_r3702624207
##########
pom.xml:
##########
@@ -956,6 +963,16 @@
</executions>
</plugin>
+ <!--
+ ~ Use Mimir as Maven cache:
+ ~ See: https://maveniverse.eu/docs/mimir/
+ -->
+ <plugin>
+ <groupId>eu.maveniverse.maven.mimir</groupId>
+ <artifactId>extension</artifactId>
+ <extensions>true</extensions>
+ </plugin>
Review Comment:
Yes, if we add it as an extension, it will be used everywhere.
There are three ways to use Mimír:
1. As a Maven 3 Core extension (in `.mvn/extensions.xml`),
2. As a Maven 3 Build extension (in `pom.xml`), or
3. As a Maven 4 extension (in `~/.m2`).
I don't see any disadvantage in using it for **all** users, do you? The local Maven repository still exists and you can still put staging artifacts there, but Mimír uses a second level cache with only Maven Central artifacts inside.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace Maven Cache with Mimír [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #389:
URL: https://github.com/apache/logging-parent/pull/389#discussion_r2096153221
##########
pom.xml:
##########
@@ -362,6 +363,12 @@
<version>${maven-artifact-plugin.version}</version>
</plugin>
+ <plugin>
Review Comment:
We usually add each plugin to the **Plugin Management** section to define its version and we activate it, by adding it to the **Plugins** section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace Maven Cache with Mimír [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on PR #389:
URL: https://github.com/apache/logging-parent/pull/389#issuecomment-2936943918
This PR
1. adds net 260 lines,
2. uses a plugin whose [README states that](https://github.com/maveniverse/mimir/blob/0a7f04f576ae18109e7cac6a55d3dc29bb034708/README.md#L9)
> this code is Proof of Concept, with a lot of To-Be-Done parts
3. for a problem (#388), which can also be solved in other simpler ways:
1. **Avoid using the Maven local repository cache** in the `verify-reproducibility-reusable` workflow.
2. **Use a dedicated Maven cache** specifically for the `verify-reproducibility-reusable` workflow, separate from the one used by build and deploy workflows.
Mimir is not a widely used plugin, no Logging Services PMC member possess experience with it, the problem at hand is not severe, and there are simpler and more familiar ways to fix the issue. @ppkarwasz, from a maintenance pov, can't we fix the issue by simply adjusting the `verify-reproducibility-reusable` workflow as you suggested?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace Maven Cache with Mimír [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on code in PR #389:
URL: https://github.com/apache/logging-parent/pull/389#discussion_r3699952585
##########
.github/workflows/build-reusable.yaml:
##########
@@ -89,7 +89,41 @@ jobs:
with:
distribution: zulu
java-version: ${{ inputs.java-version }}
- cache: maven
+
+ #
+ # Sets up Mimír (https://maveniverse.eu/docs/mimir/) to cache artifacts from remote repositories
+ #
+ # Unlike the local Maven repository, Mimír cannot be used to stage locally generated artifacts or snapshots.
+ # Therefore, it can be reused between builds, even on different architectures.
+ # Since the size of the cache increases in time, as we download new dependency versions, we reset the cache
+ # once a month.
Review Comment:
Where/How do we evict out-of-date cache entries?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org