[jira] (MRELEASE-856) setAllowTimestampedSnapshots allows non-timestamped snapshots

["John Gibson (JIRA)" <ji...@codehaus.org>]

John Gibson created MRELEASE-856:
------------------------------------

             Summary: setAllowTimestampedSnapshots allows non-timestamped snapshots
                 Key: MRELEASE-856
                 URL: https://jira.codehaus.org/browse/MRELEASE-856
             Project: Maven Release Plugin
          Issue Type: Bug
    Affects Versions: 2.4.2
            Reporter: John Gibson
         Attachments: allowTimestampedSnapshots_broken_test.patch

The documentation for the *setAllowTimestampedSnapshots* configuration option (aka *-DignoreSnapshots=true* command line option) claims that it will only allow timestamped SNAPSHOTs.  However it really allows any SNAPSHOTs, including untimestamped ones.

Part of the code tries to support this:
{code:title=CheckDependencySnapshotsPhase.java}
    private static boolean checkArtifact( Artifact artifact, Map<String, String> originalVersions, ReleaseDescriptor releaseDescriptor )
    {
        String versionlessArtifactKey = ArtifactUtils.versionlessKey( artifact.getGroupId(), artifact.getArtifactId() );

        // We are only looking at dependencies external to the project - ignore anything found in the reactor as
        // it's version will be updated
        boolean result =
            artifact.isSnapshot() && !artifact.getBaseVersion().equals( originalVersions.get( versionlessArtifactKey ) );

        // If we have a snapshot but allowTimestampedSnapshots is true, accept the artifact if the version
        // indicates that it is a timestamped snapshot.
        if ( result && releaseDescriptor.isAllowTimestampedSnapshots() )
        {
            result = artifact.getVersion().indexOf( Artifact.SNAPSHOT_VERSION ) >= 0;
        }

        return result;
    }
{code}

However that check is rendered useless by the main execute method which skips all of the checks when the *allowTimestampedSnapshots* configuration option is true.
{code:title=CheckDependencySnapshotsPhase.java}
    public ReleaseResult execute( ReleaseDescriptor releaseDescriptor, ReleaseEnvironment releaseEnvironment, List<MavenProject> reactorProjects )
        throws ReleaseExecutionException, ReleaseFailureException
    {
        ReleaseResult result = new ReleaseResult();

        if ( !releaseDescriptor.isAllowTimestampedSnapshots() )
        {
            logInfo( result, "Checking dependencies and plugins for snapshots ..." );

            Map<String, String> originalVersions = releaseDescriptor.getOriginalVersions( reactorProjects );

            for ( MavenProject project : reactorProjects )
            {
                checkProject( project, originalVersions, releaseDescriptor );
            }
        }
        else
        {
            logInfo( result, "Ignoring SNAPSHOT depenedencies and plugins ..." );
        }
        result.setResultCode( ReleaseResult.SUCCESS );

        return result;
    }
{code}

See the attached test case for an example of it breaking.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira