You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@logging.apache.org by "Piotr P. Karwasz" <pi...@mailing.copernik.eu> on 2025/07/08 08:36:50 UTC
[DISCUSSION][VOTE] Release Apache Log4j `2.25.1` (RC1)
Hi Matt,
On 7.07.2025 22:34, Matt Sicker wrote:
> Something is buggy for me in the Maven wrapper script which causes this error to print out:
>
> mvnw: line 114: mvnw/.mvn/wrapper/maven-wrapper.properties: Not a directory
> cannot read distributionUrl property in mvnw/.mvn/wrapper/maven-wrapper.properties
This is a known bug in Maven Wrapper—see Volkan's e-mail.
> When I tried running the build with a local copy of Maven, I get a different error:
>
> [ERROR] size mismatch log4j-api-2.25.1-sources.jar: investigate with diffoscope log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1-sources.jar log4j-api/target/log4j-api-2.25.1-sources.jar
> [ERROR] size mismatch log4j-api-2.25.1.module: investigate with diffoscope log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1.module log4j-api/target/publications/maven/module.json
> [ERROR] Reproducible Build output summary: 3 files ok, 2 different
> [ERROR] see diff log4j-api/target/reference/log4j-api-2.25.1.buildinfo log4j-api/target/log4j-api-2.25.1.buildinfo
>
> The diff:
As I’ve mentioned before—e.g., in a similar report from Gary[1]—running
the final `diff` command is rarely useful. It only confirms that files
differ (as already stated) and in this case, mainly reveals that your
build was done on macOS.
Instead, could you please run the `diffoscope` commands listed earlier
in the output? These are much more helpful for diagnosing actual
differences:
diffoscope
log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1-sources.jar
log4j-api/target/log4j-api-2.25.1-sources.jar
diffoscope
log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1.module
log4j-api/target/publications/maven/module.json
Piotr
PS: I’ve submitted a bug report / feature request[2] to improve the
clarity of this error message. If you have a moment, could you take a
look and let me know if the suggestions make sense?
[1] https://lists.apache.org/thread/q8vyzndb4g6sfzk0xw8ofgnfv32o6ox6
[2] https://github.com/apache/maven-artifact-plugin/issues/175
Re: [DISCUSSION][VOTE] Release Apache Log4j `2.25.1` (RC1)
Posted by "Piotr P. Karwasz" <pi...@mailing.copernik.eu>.
Hi Gary,
On 9.07.2025 14:35, Gary Gregory wrote:
> Dare I ask my our build has Gradle horror in it?
It’s not a horror—it’s a tragedy. A well-intentioned series of events
that slowly spiraled into pain:
## Episode 1: Runtime-Invisible Annotations
Over the past two years, we began using several compile-time annotations
with retention policy `CLASS`:
* `@BaselineIgnore`: Suppresses binary compatibility warnings for
changes that are technically incompatible but safe in practice—for
example, removing a `public` class clearly marked as internal.
* `@SuppressFBWarnings`: Suppresses SpotBugs reports for code that may
appear insecure (e.g. file handling) but is verified to be safe.
* `@InlineMe`: An Error Prone annotation that helps users migrate away
from deprecated methods by suggesting inline replacements.
These annotations are not retained at runtime, so we declared the
corresponding libraries with `provided` scope, ensuring they aren't
transitively exposed to downstream users.
## Episode 2: The JDK Linter Bug
Despite being non-runtime annotations, the JDK’s `-Xlint:classfile`
option still expects these annotations to be present at compile time. If
they're missing, the linter emits warnings.
This behavior seemed questionable, so I filed a bug report with the JDK
team:
https://bugs.openjdk.org/browse/JDK-8342833
While opinions vary on whether this check is useful, it introduced
real-world complications in builds that rely on clean linter output.
## Episode 3: Build Failures and User Complaints
The combination of annotations and linter sensitivity caused build
failures for users compiling with strict flags like
`-Xlint:all -Werror`.
Example issue report and analysis:
https://github.com/apache/logging-log4j2/issues/3110#issuecomment-2423586754
Although most of these annotations are in `log4j-core`—which shouldn't
typically be on users' compile classpaths—many projects still include it
during compilation, intentionally or not.
## Episode 4: Enter GMM
Adding runtime dependencies just to silence compile-time linter warnings
was not acceptable, but Maven’s limited scope model offers no good
workaround. As a result, Maven users were simply told to ignore the
warnings.
However, for Gradle users, a better option emerged: Jendrik proposed
using the Gradle Module Metadata Maven Plugin in
https://github.com/apache/logging-log4j2/issues/3437
This plugin lets us publish enriched metadata that tells Gradle which
dependencies are compile-only but transitive. Gradle can then resolve
annotation libraries during compilation—without leaking them into the
runtime classpath.
## Finale: Version 2.25.0 – Return of the Karma
The plot thickened in the `2.25.0` release, when we unintentionally
upgraded `spotbugs-annotations` to version `4.9.0`—a version **not
compatible with Java 8**.
At first glance, this seemed harmless. After all, `spotbugs-annotations`
is a **compile-only** dependency. If you’re compiling with JDK 11+ and
targeting Java 8, everything should be fine... right?
Unfortunately, no.
Due to a perfect storm of factors—including `spotbugs-annotations`
publishing its own Gradle Module Metadata and our own use of the GMM
plugin—Gradle users compiling for Java 8 found themselves unable to
build against Log4j `2.25.0`.
The issue is documented here:
https://github.com/apache/logging-log4j2/issues/3754
So despite our best intentions, trying to improve metadata fidelity
ended up triggering build failures for a portion of our users. The karma
of well-meant tooling struck back.
Scene,
Piotr
Re: [DISCUSSION][VOTE] Release Apache Log4j `2.25.1` (RC1)
Posted by Gary Gregory <ga...@gmail.com>.
Dare I ask my our build has Gradle horror in it?
Gary
On Wed, Jul 9, 2025, 04:48 Piotr P. Karwasz <pi...@mailing.copernik.eu>
wrote:
> Hi Matt,
> On 8.07.2025 22:14, Matt Sicker wrote:
>
> [image: gist-og-image-54fd7dc0713e.png]
>
> gist:54c8222bd8ef3dabd690994ab35d85d2
> <https://gist.github.com/jvz/54c8222bd8ef3dabd690994ab35d85d2>
> gist.github.com
> <https://gist.github.com/jvz/54c8222bd8ef3dabd690994ab35d85d2>
> <https://gist.github.com/jvz/54c8222bd8ef3dabd690994ab35d85d2>
>
> Logs say the diff is mainly due to compression levels.
>
> Thanks! I was eventually able to reproduce the issue as well. The
> differences appear to stem from the embedded pom.xml and involve the
> Gradle Module Metadata Maven Plugin.
>
> Before publication, the pom.xml is modified in two steps:
>
> 1.
>
> The revision property is resolved by the Flatten Maven Plugin.
> 2.
>
> A <!-- do_not_remove: published-with-gradle-metadata --> comment is
> inserted by the GMM Maven Plugin.
>
> The release candidate includes this comment, while your local build does
> not. This could be due to a variation in plugin execution order—both the
> Maven Source Plugin and the GMM Maven Plugin are bound to the package
> phase, so the final result can depend on which one runs first.
>
> What’s curious is that, in both Maven 3.9.8 and 3.9.10, the Source Plugin
> execution is listed first in the effective POM, so I would have expected
> the comment *not* to appear in the -sources.jar.
>
> By the way: since XML comments can be ignored by parsers, they’re stripped
> out by the Flatten Plugin before the final pom.xml is written. Kudos to
> whoever chose to use a comment rather than something like a
> published-with-gradle-metadata property.
>
> Best,
> Piotr
>
> PS: I attach my result of running `diffoscope` below:
> ---
> log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1-sources.jar
> +++ log4j-api/target/log4j-api-2.25.1-sources.jar
> ├── zipinfo {}
> │ @@ -1,8 +1,8 @@
> │ -Zip file size: 293959 bytes, number of entries: 177
> │ +Zip file size: 293922 bytes, number of entries: 177
> │ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48 META-INF/
> │ -rw-r--r-- 2.0 unx 64 b- defN 25-Jul-05 19:48
> META-INF/MANIFEST.MF
> │ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48 org/
> │ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48 org/apache/
> │ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48 org/apache/logging/
> │ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48
> org/apache/logging/log4j/
> │ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48
> org/apache/logging/log4j/internal/
> │ @@ -170,10 +170,10 @@
> │ -rw-r--r-- 2.0 unx 8556 b- defN 25-Jul-05 19:48
> org/apache/logging/log4j/util/Timer.java
> │ -rw-r--r-- 2.0 unx 1368 b- defN 25-Jul-05 19:48
> org/apache/logging/log4j/util/TriConsumer.java
> │ -rw-r--r-- 2.0 unx 10556 b- defN 25-Jul-05 19:48
> org/apache/logging/log4j/util/Unbox.java
> │ -rw-r--r-- 2.0 unx 7589 b- defN 25-Jul-05 19:48
> org/apache/logging/log4j/util/internal/SerializationUtil.java
> │ -rw-r--r-- 2.0 unx 1162 b- defN 25-Jul-05 19:48
> org/apache/logging/log4j/util/package-info.java
> │ -rw-r--r-- 2.0 unx 1645 b- defN 25-Jul-05 19:48
> Log4j-charsets.properties
> │ -rw-r--r-- 2.0 unx 143 b- defN 25-Jul-05 19:48
> META-INF/native-image/org.apache.logging.log4j/log4j-api/resource-config.json
> │ --rw-r--r-- 2.0 unx 4513 b- defN 25-Jul-05 19:48
> META-INF/maven/org.apache.logging.log4j/log4j-api/pom.xml
> │ +-rw-r--r-- 2.0 unx 4458 b- defN 25-Jul-05 19:48
> META-INF/maven/org.apache.logging.log4j/log4j-api/pom.xml
> │ -rw-r--r-- 2.0 unx 69 b- defN 25-Jul-05 19:48
> META-INF/maven/org.apache.logging.log4j/log4j-api/pom.properties
> │ -177 files, 1236315 bytes uncompressed, 263029 bytes compressed: 78.7%
> │ +177 files, 1236260 bytes uncompressed, 262992 bytes compressed: 78.7%
> ├── META-INF/maven/org.apache.logging.log4j/log4j-api/pom.xml
> │ ├── META-INF/maven/org.apache.logging.log4j/log4j-api/pom.xml
> │ │ @@ -13,15 +13,14 @@
> │ │ ~ distributed under the License is distributed on an "AS IS" BASIS,
> │ │ ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> │ │ ~ See the License for the specific language governing permissions
> and
> │ │ ~ limitations under the License.
> │ │ -->
> │ │ <project xmlns="http://maven.apache.org/POM/4.0.0"
> <http://maven.apache.org/POM/4.0.0> xmlns:xsi=
> "http://www.w3.org/2001/XMLSchema-instance"
> <http://www.w3.org/2001/XMLSchema-instance> xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
> https://maven.apache.org/xsd/maven-4.0.0.xsd"
> <http://maven.apache.org/POM/4.0.0https://maven.apache.org/xsd/maven-4.0.0.xsd>
> >
> │ │ <modelVersion>4.0.0</modelVersion>
> │ │ - <!-- do_not_remove: published-with-gradle-metadata -->
> │ │ <parent>
> │ │ <groupId>org.apache.logging.log4j</groupId>
> │ │ <artifactId>log4j</artifactId>
> │ │ <version>2.25.1</version>
> │ │ <relativePath>../log4j-parent</relativePath>
> │ │ </parent>
> │ │ <artifactId>log4j-api</artifactId>
>
Re: [DISCUSSION][VOTE] Release Apache Log4j `2.25.1` (RC1)
Posted by "Piotr P. Karwasz" <pi...@mailing.copernik.eu>.
Hi Matt,
On 8.07.2025 22:14, Matt Sicker wrote:
> gist-og-image-54fd7dc0713e.png
> gist:54c8222bd8ef3dabd690994ab35d85d2
> <https://gist.github.com/jvz/54c8222bd8ef3dabd690994ab35d85d2>
> gist.github.com
> <https://gist.github.com/jvz/54c8222bd8ef3dabd690994ab35d85d2>
>
> <https://gist.github.com/jvz/54c8222bd8ef3dabd690994ab35d85d2>
>
> Logs say the diff is mainly due to compression levels.
>
Thanks! I was eventually able to reproduce the issue as well. The
differences appear to stem from the embedded |pom.xml| and involve the
Gradle Module Metadata Maven Plugin.
Before publication, the |pom.xml| is modified in two steps:
1.
The |revision| property is resolved by the Flatten Maven Plugin.
2.
A |<!-- do_not_remove: published-with-gradle-metadata -->| comment
is inserted by the GMM Maven Plugin.
The release candidate includes this comment, while your local build does
not. This could be due to a variation in plugin execution order—both the
Maven Source Plugin and the GMM Maven Plugin are bound to the |package|
phase, so the final result can depend on which one runs first.
What’s curious is that, in both Maven 3.9.8 and 3.9.10, the Source
Plugin execution is listed first in the effective POM, so I would have
expected the comment *not* to appear in the |-sources.jar|.
By the way: since XML comments can be ignored by parsers, they’re
stripped out by the Flatten Plugin before the final |pom.xml| is
written. Kudos to whoever chose to use a comment rather than something
like a |published-with-gradle-metadata| property.
Best,
Piotr
PS: I attach my result of running `diffoscope` below:
---
log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1-sources.jar
+++ log4j-api/target/log4j-api-2.25.1-sources.jar
├── zipinfo {}
│ @@ -1,8 +1,8 @@
│ -Zip file size: 293959 bytes, number of entries: 177
│ +Zip file size: 293922 bytes, number of entries: 177
│ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48 META-INF/
│ -rw-r--r-- 2.0 unx 64 b- defN 25-Jul-05 19:48 META-INF/MANIFEST.MF
│ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48 org/
│ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48 org/apache/
│ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48 org/apache/logging/
│ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48
org/apache/logging/log4j/
│ drwxr-xr-x 2.0 unx 0 b- stor 25-Jul-05 19:48
org/apache/logging/log4j/internal/
│ @@ -170,10 +170,10 @@
│ -rw-r--r-- 2.0 unx 8556 b- defN 25-Jul-05 19:48
org/apache/logging/log4j/util/Timer.java
│ -rw-r--r-- 2.0 unx 1368 b- defN 25-Jul-05 19:48
org/apache/logging/log4j/util/TriConsumer.java
│ -rw-r--r-- 2.0 unx 10556 b- defN 25-Jul-05 19:48
org/apache/logging/log4j/util/Unbox.java
│ -rw-r--r-- 2.0 unx 7589 b- defN 25-Jul-05 19:48
org/apache/logging/log4j/util/internal/SerializationUtil.java
│ -rw-r--r-- 2.0 unx 1162 b- defN 25-Jul-05 19:48
org/apache/logging/log4j/util/package-info.java
│ -rw-r--r-- 2.0 unx 1645 b- defN 25-Jul-05 19:48
Log4j-charsets.properties
│ -rw-r--r-- 2.0 unx 143 b- defN 25-Jul-05 19:48
META-INF/native-image/org.apache.logging.log4j/log4j-api/resource-config.json
│ --rw-r--r-- 2.0 unx 4513 b- defN 25-Jul-05 19:48
META-INF/maven/org.apache.logging.log4j/log4j-api/pom.xml
│ +-rw-r--r-- 2.0 unx 4458 b- defN 25-Jul-05 19:48
META-INF/maven/org.apache.logging.log4j/log4j-api/pom.xml
│ -rw-r--r-- 2.0 unx 69 b- defN 25-Jul-05 19:48
META-INF/maven/org.apache.logging.log4j/log4j-api/pom.properties
│ -177 files, 1236315 bytes uncompressed, 263029 bytes compressed: 78.7%
│ +177 files, 1236260 bytes uncompressed, 262992 bytes compressed: 78.7%
├── META-INF/maven/org.apache.logging.log4j/log4j-api/pom.xml
│ ├── META-INF/maven/org.apache.logging.log4j/log4j-api/pom.xml
│ │ @@ -13,15 +13,14 @@
│ │ ~ distributed under the License is distributed on an "AS IS" BASIS,
│ │ ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied.
│ │ ~ See the License for the specific language governing permissions and
│ │ ~ limitations under the License.
│ │ -->
│ │ <project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
https://maven.apache.org/xsd/maven-4.0.0.xsd">
│ │ <modelVersion>4.0.0</modelVersion>
│ │ - <!-- do_not_remove: published-with-gradle-metadata -->
│ │ <parent>
│ │ <groupId>org.apache.logging.log4j</groupId>
│ │ <artifactId>log4j</artifactId>
│ │ <version>2.25.1</version>
│ │ <relativePath>../log4j-parent</relativePath>
│ │ </parent>
│ │ <artifactId>log4j-api</artifactId>
Re: [DISCUSSION][VOTE] Release Apache Log4j `2.25.1` (RC1)
Posted by Matt Sicker <ma...@musigma.org>.
https://gist.github.com/jvz/54c8222bd8ef3dabd690994ab35d85d2
gist:54c8222bd8ef3dabd690994ab35d85d2
gist.github.com
Logs say the diff is mainly due to compression levels.
> On Jul 8, 2025, at 13:38, Piotr P. Karwasz <pi...@mailing.copernik.eu> wrote:
>
> Hi Matt,
>
> On 8.07.2025 18:34, Matt Sicker wrote:
>> The diffoscope output for the module file is simple:
>>
>> [...]
>> │ "createdBy": {
>> │ "maven": {
>> │ - "version": "3.9.8"
>> │ + "version": "3.9.10"
>> │ }
>
> I didn't know about this aspect of the Gradle Module Metadata (GMM)
> Maven Plugin, but the error makes sense now: the difference is due to
> the Maven version used.
>
> To address this, I’ve opened a feature request in the GMM Maven Plugin
> to stop generating the optional `createdBy` field altogether:
>
> https://github.com/gradlex-org/gradle-module-metadata-maven-plugin/issues/43
>
> This should improve reproducibility and make it easier to verify future
> Log4j releases.
>
>> The diffoscope output for the other file has substantial changes
>> (probably related to version differences).
>
> The differences in the `-sources.jar` are a bit more concerning. While
> it’s more of a documentation artifact than the actual source code of
> Log4j, unexpected changes there still raise questions.
>
> Unlike the `.module` file issue—which I can reproduce by switching to
> Maven 3.9.10—I haven't been able to reproduce the `-sources.jar`
> differences on Linux. Could you upload your `diffoscope` output to a
> Gist or share a summary of the key differences you’re seeing?
>
> Piotr
>
>
Re: [DISCUSSION][VOTE] Release Apache Log4j `2.25.1` (RC1)
Posted by "Piotr P. Karwasz" <pi...@mailing.copernik.eu>.
Hi Matt,
On 8.07.2025 18:34, Matt Sicker wrote:
> The diffoscope output for the module file is simple:
>
> [...]
> │ "createdBy": {
> │ "maven": {
> │ - "version": "3.9.8"
> │ + "version": "3.9.10"
> │ }
I didn't know about this aspect of the Gradle Module Metadata (GMM)
Maven Plugin, but the error makes sense now: the difference is due to
the Maven version used.
To address this, I’ve opened a feature request in the GMM Maven Plugin
to stop generating the optional `createdBy` field altogether:
https://github.com/gradlex-org/gradle-module-metadata-maven-plugin/issues/43
This should improve reproducibility and make it easier to verify future
Log4j releases.
> The diffoscope output for the other file has substantial changes
> (probably related to version differences).
The differences in the `-sources.jar` are a bit more concerning. While
it’s more of a documentation artifact than the actual source code of
Log4j, unexpected changes there still raise questions.
Unlike the `.module` file issue—which I can reproduce by switching to
Maven 3.9.10—I haven't been able to reproduce the `-sources.jar`
differences on Linux. Could you upload your `diffoscope` output to a
Gist or share a summary of the key differences you’re seeing?
Piotr
Re: [DISCUSSION][VOTE] Release Apache Log4j `2.25.1` (RC1)
Posted by Matt Sicker <ma...@musigma.org>.
The diffoscope output for the module file is simple:
diffoscope log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1.module log4j-api/target/publications/maven/module.json
--- log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1.module
+++ log4j-api/target/publications/maven/module.json
├── Pretty-printed
│ @@ -5,15 +5,15 @@
│ },
│ "group": "org.apache.logging.log4j",
│ "module": "log4j-api",
│ "version": "2.25.1"
│ },
│ "createdBy": {
│ "maven": {
│ - "version": "3.9.8"
│ + "version": "3.9.10"
│ }
│ },
│ "formatVersion": "1.1",
│ "variants": [
│ {
│ "attributes": {
│ "org.gradle.category": "library”,
The diffoscope output for the other file has substantial changes (probably related to version differences).
> On Jul 8, 2025, at 03:36, Piotr P. Karwasz <pi...@mailing.copernik.eu> wrote:
>
> Hi Matt,
>
> On 7.07.2025 22:34, Matt Sicker wrote:
>> Something is buggy for me in the Maven wrapper script which causes this error to print out:
>>
>> mvnw: line 114: mvnw/.mvn/wrapper/maven-wrapper.properties: Not a directory
>> cannot read distributionUrl property in mvnw/.mvn/wrapper/maven-wrapper.properties
>
> This is a known bug in Maven Wrapper—see Volkan's e-mail.
>
>> When I tried running the build with a local copy of Maven, I get a different error:
>>
>> [ERROR] size mismatch log4j-api-2.25.1-sources.jar: investigate with diffoscope log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1-sources.jar log4j-api/target/log4j-api-2.25.1-sources.jar
>> [ERROR] size mismatch log4j-api-2.25.1.module: investigate with diffoscope log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1.module log4j-api/target/publications/maven/module.json
>> [ERROR] Reproducible Build output summary: 3 files ok, 2 different
>> [ERROR] see diff log4j-api/target/reference/log4j-api-2.25.1.buildinfo log4j-api/target/log4j-api-2.25.1.buildinfo
>>
>> The diff:
>
> As I’ve mentioned before—e.g., in a similar report from Gary[1]—running
> the final `diff` command is rarely useful. It only confirms that files
> differ (as already stated) and in this case, mainly reveals that your
> build was done on macOS.
>
> Instead, could you please run the `diffoscope` commands listed earlier
> in the output? These are much more helpful for diagnosing actual
> differences:
>
>
> diffoscope
> log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1-sources.jar
> log4j-api/target/log4j-api-2.25.1-sources.jar
> diffoscope
> log4j-api/target/reference/org.apache.logging.log4j/log4j-api-2.25.1.module
> log4j-api/target/publications/maven/module.json
>
> Piotr
>
> PS: I’ve submitted a bug report / feature request[2] to improve the
> clarity of this error message. If you have a moment, could you take a
> look and let me know if the suggestions make sense?
>
> [1] https://lists.apache.org/thread/q8vyzndb4g6sfzk0xw8ofgnfv32o6ox6
> [2] https://github.com/apache/maven-artifact-plugin/issues/175
>
>
>
>