You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@maven.apache.org by Jan Fredrik Wedén <jf...@gmail.com> on 2008/07/03 16:28:36 UTC
Lock down of plugin versions
Greetings,
I'm attempting to follow best practice and lock down plugins in our
parent POM. From what I understand, I should use a version range
instead of a plain version number to accomplish a true lock down for
future reproducibility. E.g. for the clean plugin I would use [2.2]
instead of just 2.2 as Maven considers the latter to be a
recommendation rather than a requirement.
Now trouble starts, I attempt to put the pluginManagement section
below in my POM and execute mvn clean. From the output below it seems
like Maven is attempting to resolve the version as "[2.2]" instead of
resolving the range to a fixed version first. The same thing happens
when I try to add the plugin definitions to <build><plugins> instead.
However, a version range in my dependencies section resolves like a
charm. Could be that I've not understood how plugin lock down should
work, though...
I'm running Maven 2.0.9 on Windows JDK 1.5 through Cygwin. We have set
up Proximity as a corporate proxy and I have followed the guide in the
Sonatype book to configure repositories and mirrors in my settings.
Adding this block to my POM:
<pluginManagement>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-clean-plugin</artifactId>
<version>[2.2]</version>
</plugin>
</plugins>
</pluginManagement>
Produces the output below:
$ mvn clean -N
[INFO] Scanning for projects...
[INFO] ------------------------------------------------------------------------
[INFO] Building CORP parent POM
[INFO] task-segment: [clean]
[INFO] ------------------------------------------------------------------------
Downloading: http://corp-server/proximity/repository/external/org/apache/maven/plugins/maven-clean-plugin/[2.2]/maven-clean-plugin-[2.2].pom
Downloading: http://corp-server/proximity/repository/public/org/apache/maven/plugins/maven-clean-plugin/[2.2]/maven-clean-plugin-[2.2].pom
[INFO] ------------------------------------------------------------------------
[ERROR] BUILD ERROR
[INFO] ------------------------------------------------------------------------
[INFO] Failed to resolve artifact.
GroupId: org.apache.maven.plugins
ArtifactId: maven-clean-plugin
Version: [2.2]
Reason: Unable to download the artifact from any repository
org.apache.maven.plugins:maven-clean-plugin:pom:[2.2]
from the specified remote repositories:
px-external (http://corp-server/proximity/repository/external),
px-public (http://corp-server/proximity/repository/public)
[INFO] ------------------------------------------------------------------------
[INFO] For more information, run Maven with the -e switch
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1 second
[INFO] Finished at: Thu Jul 03 16:16:54 CEST 2008
[INFO] Final Memory: 2M/63M
[INFO] ------------------------------------------------------------------------
Any clues?
--
- Jan Fredrik Wedén
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Lock down of plugin versions
Posted by Michael McCallum <gh...@apache.org>.
i don't think plugin resolution supports ranges, the brackets are implied for
plugins in that they are all strict versions.
i've have go back and read the code again...
On Fri, 04 Jul 2008 03:12:35 André Kelpe wrote:
> Hi Jan!
>
> > I'm running Maven 2.0.9 on Windows JDK 1.5 through Cygwin. We have set
> > up Proximity as a corporate proxy and I have followed the guide in the
> > Sonatype book to configure repositories and mirrors in my settings.
> >
> > Adding this block to my POM:
> >
> > <pluginManagement>
> > <plugins>
> > <plugin>
> > <groupId>org.apache.maven.plugins</groupId>
> > <artifactId>maven-clean-plugin</artifactId>
> > <version>[2.2]</version>
> > </plugin>
> > </plugins>
> > </pluginManagement>
>
> Removing the brackets from the version, if you do not use ranges
> should do the trick.
>
> HTH
>
> André
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
--
Michael McCallum
Enterprise Engineer
mailto:gholam@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Lock down of plugin versions
Posted by Jan Fredrik Wedén <jf...@gmail.com>.
On Thu, Jul 3, 2008 at 5:12 PM, André Kelpe
<ef...@googlemail.com> wrote:
> Hi Jan!
>
>> I'm running Maven 2.0.9 on Windows JDK 1.5 through Cygwin. We have set
>> up Proximity as a corporate proxy and I have followed the guide in the
>> Sonatype book to configure repositories and mirrors in my settings.
>>
>> Adding this block to my POM:
>>
>> <pluginManagement>
>> <plugins>
>> <plugin>
>> <groupId>org.apache.maven.plugins</groupId>
>> <artifactId>maven-clean-plugin</artifactId>
>> <version>[2.2]</version>
>> </plugin>
>> </plugins>
>> </pluginManagement>
>>
>
> Removing the brackets from the version, if you do not use ranges
> should do the trick.
>
Yes, it does build if I remove the brackets. However, my understanding
was that I needed the brackets to truly "lock down" the plugin
versions. Maybe I've just misunderstood previous discussions and that
this type of lock down is not needed/supported for plugins and that a
plain, single version number is indeed enough.
However, I did perform an additional test to check what happened if I
did want to use "real" version ranges for plugins. This scenario
breaks as well while it work perfectly well with dependencies. So
maybe I did miss some part of the docs where it says ranges are not to
be used for plugins...
--
- Jan Fredrik Wedén
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Lock down of plugin versions
Posted by André Kelpe <ef...@googlemail.com>.
Hi Jan!
> I'm running Maven 2.0.9 on Windows JDK 1.5 through Cygwin. We have set
> up Proximity as a corporate proxy and I have followed the guide in the
> Sonatype book to configure repositories and mirrors in my settings.
>
> Adding this block to my POM:
>
> <pluginManagement>
> <plugins>
> <plugin>
> <groupId>org.apache.maven.plugins</groupId>
> <artifactId>maven-clean-plugin</artifactId>
> <version>[2.2]</version>
> </plugin>
> </plugins>
> </pluginManagement>
>
Removing the brackets from the version, if you do not use ranges
should do the trick.
HTH
André
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
RE: Lock down of plugin versions
Posted by "Brian E. Fox" <br...@reply.infinity.nu>.
>What you're saying sounds reasonable, I agree. Still waiting for
>Enforcer 1.0 release to take advantage of requirePluginVersions,
>though :-) Any updates, Brian?
No, sorry. I am unable to replicate the issue I saw once at a customer
site, so I might just move forward with another beta release.
>Whenever version ranges were mentioned in
>Mavenland it stated that a plain version was a recommendation, while a
>plain version surrounded by brackets was a requirement ("locked down"
>version). From my tiny experiment here, and people's responses, I take
>it that just a plain version will achieve what I want for plugins.
This is true for dependencies because of the transitivity. Plugins are
not transitive in the same way, so there's no need for ranges...in fact
I'm not sure what happens if you use a range for a plugin, never thought
about it before.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Lock down of plugin versions
Posted by Jan Fredrik Wedén <jf...@gmail.com>.
What you're saying sounds reasonable, I agree. Still waiting for
Enforcer 1.0 release to take advantage of requirePluginVersions,
though :-) Any updates, Brian?
My original attempt at this started from reading the users list and
docs about version ranges. Whenever version ranges were mentioned in
Mavenland it stated that a plain version was a recommendation, while a
plain version surrounded by brackets was a requirement ("locked down"
version). From my tiny experiment here, and people's responses, I take
it that just a plain version will achieve what I want for plugins.
I'll start implementing this for our POMs.
Thanks for all your input.
On Sun, Jul 6, 2008 at 9:36 AM, Wouter Hermeling <wh...@gmail.com> wrote:
>
> Imo version ranges are best used for developing plugins, more specifically
> plugin dependencies. By using a version range for a dependency rather then a
> specific version, the plugin can be more easily used in a different poms
> using different versions of dependencies.
>
> I've done a full lock down of plugin versions by specifying the actual
> version and not the version range in the pom.xml. The maven-enforce-plugin
> and specifically the rule 'requirePluginVersions' can help you with this.
>
>
>
> Jan Fredrik Wedén wrote:
>>
>> Greetings,
>>
>> I'm attempting to follow best practice and lock down plugins in our
>> parent POM. From what I understand, I should use a version range
>> instead of a plain version number to accomplish a true lock down for
>> future reproducibility. E.g. for the clean plugin I would use [2.2]
>> instead of just 2.2 as Maven considers the latter to be a
>> recommendation rather than a requirement.
>>
>> Now trouble starts, I attempt to put the pluginManagement section
>> below in my POM and execute mvn clean. From the output below it seems
>> like Maven is attempting to resolve the version as "[2.2]" instead of
>> resolving the range to a fixed version first. The same thing happens
>> when I try to add the plugin definitions to <build><plugins> instead.
>> However, a version range in my dependencies section resolves like a
>> charm. Could be that I've not understood how plugin lock down should
>> work, though...
>>
>> I'm running Maven 2.0.9 on Windows JDK 1.5 through Cygwin. We have set
>> up Proximity as a corporate proxy and I have followed the guide in the
>> Sonatype book to configure repositories and mirrors in my settings.
>>
>> Adding this block to my POM:
>>
>> <pluginManagement>
>> <plugins>
>> <plugin>
>> <groupId>org.apache.maven.plugins</groupId>
>> <artifactId>maven-clean-plugin</artifactId>
>> <version>[2.2]</version>
>> </plugin>
>> </plugins>
>> </pluginManagement>
>>
>> Produces the output below:
>>
>> $ mvn clean -N
>> [INFO] Scanning for projects...
>> [INFO]
>> ------------------------------------------------------------------------
>> [INFO] Building CORP parent POM
>> [INFO] task-segment: [clean]
>> [INFO]
>> ------------------------------------------------------------------------
>> Downloading:
>> http://corp-server/proximity/repository/external/org/apache/maven/plugins/maven-clean-plugin/[2.2]/maven-clean-plugin-[2.2].pom
>> Downloading:
>> http://corp-server/proximity/repository/public/org/apache/maven/plugins/maven-clean-plugin/[2.2]/maven-clean-plugin-[2.2].pom
>> [INFO]
>> ------------------------------------------------------------------------
>> [ERROR] BUILD ERROR
>> [INFO]
>> ------------------------------------------------------------------------
>> [INFO] Failed to resolve artifact.
>>
>> GroupId: org.apache.maven.plugins
>> ArtifactId: maven-clean-plugin
>> Version: [2.2]
>>
>> Reason: Unable to download the artifact from any repository
>>
>> org.apache.maven.plugins:maven-clean-plugin:pom:[2.2]
>>
>> from the specified remote repositories:
>> px-external (http://corp-server/proximity/repository/external),
>> px-public (http://corp-server/proximity/repository/public)
>>
>>
>> [INFO]
>> ------------------------------------------------------------------------
>> [INFO] For more information, run Maven with the -e switch
>> [INFO]
>> ------------------------------------------------------------------------
>> [INFO] Total time: 1 second
>> [INFO] Finished at: Thu Jul 03 16:16:54 CEST 2008
>> [INFO] Final Memory: 2M/63M
>> [INFO]
>> ------------------------------------------------------------------------
>>
>>
>> Any clues?
>>
>> --
>> - Jan Fredrik Wedén
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>> For additional commands, e-mail: users-help@maven.apache.org
>>
>>
>>
>
> --
> View this message in context: http://www.nabble.com/Lock-down-of-plugin-versions-tp18260685p18299612.html
> Sent from the Maven - Users mailing list archive at Nabble.com.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
--
- Jan Fredrik Wedén
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Lock down of plugin versions
Posted by Wouter Hermeling <wh...@gmail.com>.
Imo version ranges are best used for developing plugins, more specifically
plugin dependencies. By using a version range for a dependency rather then a
specific version, the plugin can be more easily used in a different poms
using different versions of dependencies.
I've done a full lock down of plugin versions by specifying the actual
version and not the version range in the pom.xml. The maven-enforce-plugin
and specifically the rule 'requirePluginVersions' can help you with this.
Jan Fredrik Wedén wrote:
>
> Greetings,
>
> I'm attempting to follow best practice and lock down plugins in our
> parent POM. From what I understand, I should use a version range
> instead of a plain version number to accomplish a true lock down for
> future reproducibility. E.g. for the clean plugin I would use [2.2]
> instead of just 2.2 as Maven considers the latter to be a
> recommendation rather than a requirement.
>
> Now trouble starts, I attempt to put the pluginManagement section
> below in my POM and execute mvn clean. From the output below it seems
> like Maven is attempting to resolve the version as "[2.2]" instead of
> resolving the range to a fixed version first. The same thing happens
> when I try to add the plugin definitions to <build><plugins> instead.
> However, a version range in my dependencies section resolves like a
> charm. Could be that I've not understood how plugin lock down should
> work, though...
>
> I'm running Maven 2.0.9 on Windows JDK 1.5 through Cygwin. We have set
> up Proximity as a corporate proxy and I have followed the guide in the
> Sonatype book to configure repositories and mirrors in my settings.
>
> Adding this block to my POM:
>
> <pluginManagement>
> <plugins>
> <plugin>
> <groupId>org.apache.maven.plugins</groupId>
> <artifactId>maven-clean-plugin</artifactId>
> <version>[2.2]</version>
> </plugin>
> </plugins>
> </pluginManagement>
>
> Produces the output below:
>
> $ mvn clean -N
> [INFO] Scanning for projects...
> [INFO]
> ------------------------------------------------------------------------
> [INFO] Building CORP parent POM
> [INFO] task-segment: [clean]
> [INFO]
> ------------------------------------------------------------------------
> Downloading:
> http://corp-server/proximity/repository/external/org/apache/maven/plugins/maven-clean-plugin/[2.2]/maven-clean-plugin-[2.2].pom
> Downloading:
> http://corp-server/proximity/repository/public/org/apache/maven/plugins/maven-clean-plugin/[2.2]/maven-clean-plugin-[2.2].pom
> [INFO]
> ------------------------------------------------------------------------
> [ERROR] BUILD ERROR
> [INFO]
> ------------------------------------------------------------------------
> [INFO] Failed to resolve artifact.
>
> GroupId: org.apache.maven.plugins
> ArtifactId: maven-clean-plugin
> Version: [2.2]
>
> Reason: Unable to download the artifact from any repository
>
> org.apache.maven.plugins:maven-clean-plugin:pom:[2.2]
>
> from the specified remote repositories:
> px-external (http://corp-server/proximity/repository/external),
> px-public (http://corp-server/proximity/repository/public)
>
>
> [INFO]
> ------------------------------------------------------------------------
> [INFO] For more information, run Maven with the -e switch
> [INFO]
> ------------------------------------------------------------------------
> [INFO] Total time: 1 second
> [INFO] Finished at: Thu Jul 03 16:16:54 CEST 2008
> [INFO] Final Memory: 2M/63M
> [INFO]
> ------------------------------------------------------------------------
>
>
> Any clues?
>
> --
> - Jan Fredrik Wedén
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
>
--
View this message in context: http://www.nabble.com/Lock-down-of-plugin-versions-tp18260685p18299612.html
Sent from the Maven - Users mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org