Maven dependency not getting corresponding POM file downloaded

Question

I've got a maven project that has a dependency that it gets from a remote Nexus repository. I believe that the dependency was not built with maven, and just uploaded with a barebones POM file. The layout on the server looks fine though, so it was probably deployed with maven.

When maven downloads the dependency to my local repository, it downloads the jar file, but doesn't get the POM. At build time, there's a warning that the POM couldn't be found, and no dependency information available. I'm not actually using any of its code directly (it's actually a transitive dependency), so build completes successfully.

The real problem arises when I try to perform site generation for my project. The part that tries to generate the dependency graph report fails, because it can't find the POM for this dependency to work with.

I can't figure out why I'm not getting the POM downloaded, when the jar file for it gets downloaded just fine.

The POM file for that particular dependency looks like this (you can see why I don't think it's built with maven :))

<project>
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.company.component</groupId>
    <artifactId>my-artifact</artifactId>
    <version>1.0.1</version>
</project>

You'll notice that the root <project> element doesn't contain any namespace or schema information. Could this be related? Could it be Nexus not recognizing it as a POM? Apart from the possibility of some small syntactical character missing or mistaken, this is my current train of thought...please don't let it influence any ideas you may have! :)

Also, while troubleshooting, I've pasted the contents of the remote POM file into the correct file location in my local .m2 repo. Everything works fine when I do that. This isn't an acceptable fix though, because we will need the build to be done on our CI build servers.

Any help/suggestions greatly appreciated!

Edit:

I've managed to temporarily solve my actual problem, but the strangeness here still exists. I solved the problem by explicitly excluding the thing that depends on this from the dependency that's in my pom (the trouble dep is two steps away at least, and I'm not using anything that uses the thing that pulls it in):

<dependency>
    <groupId>com.company.utility</groupId>
    <artifactId>shared-utility</artifactId>
    <version>1.2.3</version>

    <exclusions>
        <exclusion>
            <groupId>com.company.common.component</groupId>
            <artifactId>thing-that-puls-in-bad-artifact</artifactId>
        </exclusion>
    </exclusions>
</dependency>

I've created a dummy project to prove it, with the following POM:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>com.company.project</groupId>
    <artifactId>my-project</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <dependencies>
        <dependency>
            <groupId>com.company.component</groupId>
            <artifactId>bad-artifact</artifactId>
            <version>1.0.1</version>
        </dependency>
    </dependencies>
</project>

Now in ~/.m2/repository/com/company/compnent/bad-artifact/1.0.1/, I've got:

_remote.repositories
bad-artifact-1.0.1.jar
bad-artifact-1.0.1.jar.sha1
bad-artifact-1.0.1.pom.lastUpdated

With no actual POM file.

Answer 1

If you look inside of _remote.repositories, then this file probably contains information which says "downloading the POM failed last time, don't try it again."

That's one of the things where Maven's policy "don't try to download releases again" gets in your way. Try to delete the folder ~/.m2/repository/com/company/compnent/bad-artifact/1.0.1/ and run Maven again to see the error.

It's quite possible that Maven refuses to use such a broken POM since the root element doesn't have the correct XML namespace. But it's hard to tell without seeing the actual error message.

A way to fix this is to download the JAR and to use mvn install:install-file from the command line to install the dependency locally. Even better, you can use mvn deploy:deploy-file to deploy it to your own Nexus server so all other developers now get a "good" version of the POM.

You should also get in contact with the people running the remote Nexus server so they can fix the issue.

Answer 2

Not related to your actual problem, but with maven (at least, recent version), generated jar contains their pom.xml in the META-INF/maven folder of that jar.

You should try to run maven with -e -X, and move your local repository to force Maven to download all, again.

mv "~/.m2/repository" "~/.m2/repository.old"
mvn -X -e dependency:tree

[edit] it was initially a comment, but it will be too long:

As far as I understand your problem, I think it is an error on Nexus, and not on your machine. Any valid solution would require you to mess with that your company Nexus. If you don't have permissions to do anything with your Company Nexus, you can test it with a local Nexus.

You can also enforce use of that Nexus in your ~/.m2/settings.xml like this:

<mirrors>
    <mirror>
      <id>nexus-local-central</id>
      <mirrorOf>central</mirrorOf>
      <url>http://localhost:8081/nexus/content/repositories/central</url>
    </mirror>
    <mirror>
      <id>nexus-local-any</id>
      <mirrorOf>external:*</mirrorOf>
      <url>http://localhost:8081/nexus/content/groups/public</url>
    </mirror>
</mirrors>

You should not lose too much time as to why it fails, but focus on making it working.

For that, I think you should write a valid pom.xml for that artifact, and redeploy it on the server using the pomFile option:

mvn deploy:deploy-file -DpomFile=valid-pom.xml -Dfile=foobar.jar -Durl=http://nexus:8081 -DrepositoryId=company-nexus-deploy

Or if you are too lazy (or if this command fail), do it from the Nexus GUI!

PS: the Nexus default admin login/password are admin/admin123, and I think there was also deploy/deploy123 for deployment. Most Nexus that I've seen were not configured to use another login/password.