Upload to Maven Central suddenly stopped working

[helpermethod]

Hi!

After updating dependencies for quite a while, I thought it would be a good idea to perform a patch release, to see if the deployment is still working. Apparently, it doesn't 😄. For some reason jreleaser is now trying to upload a -build.jar, which obviously fails. Is this a bug or did some config change in the meantime?

https://github.com/helpermethod/zip-forge/actions/runs/8566243117/job/23475652867#step:4:126

[aalmiray]

It looks like artifacts were built with Maven 4 and the consumer pom feature was active. I don't know why the build pom was left with a snapshot version while the consumer pom has a non snapshot version.

However, given that JReleaser takes all staged artifacts as is I believe the problem may be in Maven during staging. Please check staged artifacts locally to find out the difference.

[helpermethod]

Ah, good point! I'll check if Maven is actually the problem!

[aalmiray]

However, there is a chance for JReleaser to expect *-build.jar, *-build-sources.jar, and *-build-javadoc.jar as if *-build was a valid version with a build tag attached. This of course would make deployment fail.

UPDATE: yeah, it actually happened looking at the linked log

Error:     [nexus2] zip-forge-1.0.1-build.jar is missing
Error:     [nexus2] zip-forge-1.0.1-build-sources.jar is missing
Error:     [nexus2] zip-forge-1.0.1-build-javadoc.jar is missing

JReleaser must learn how to handle *-build.pom

[aalmiray]

Filed #1632

[helpermethod]

It's funny that this actually worked when releasing version 1.0.0 🤔

[aalmiray]

There is no *-build.pom in 1.0.0 https://repo1.maven.org/maven2/io/github/helpermethod/zip-forge/1.0.0/

[helpermethod]

Okay, finally found a few minutes to look into the problem. But now I wonder what is actually a build POM? I know Maven 4 has the concept of a consumer POM, but never heard of a -build.pom.

I also don't see anything like that when running ./mvnw verify -Drevision=1.0.1.

$ cd zip-forge/target
$ fd pom
maven-archiver/pom.properties
project-local-repo/io.github.helpermethod/zip-forge/1.0.1/zip-forge-1.0.1-consumer.pom
project-local-repo/io.github.helpermethod/zip-forge/1.0.1/zip-forge-1.0.1.pom

The consumer POM contains the resolved revision

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>io.github.helpermethod</groupId>
  <artifactId>zip-forge</artifactId>
  <version>1.0.1</version>

[aalmiray]

AFAIU the build pom is the one you wrote (the original pom) while the consumer pom is the transformed pom that does not contain build instructions.

[helpermethod]

Nevermind, the -build.pom is created by ./mvnw install.

[helpermethod]

@aalmiray I gave the new jreleaser release a try, but the Maven Central upload still fails, because jreleaser tries to upload the -build POM, which according to my understanding

• should not be uploaded
• is invalid because it does not contain a non-SNAPSHOT version (only in my case, because I am using CI friendly versions)

https://github.com/helpermethod/zip-forge/actions/runs/8912966452/job/24477519391#step:4:167

[aalmiray]

This might be a bug in the build/consumer pom as the revision property is set externally but disregarded when computing the build pom.

FWIW JReleaser and pomchecker are failing as expected because a pom was found to have a snapshot version when it shouldn't. The advantage if splitting staging and release gives you the option to update files in between steps. You may automate this with a script hook before the deploy step.

[aalmiray]

This is definitely a problem on the Maven side. How to reproduce:

1. Clone https://github.com/helpermethod/zip-forge.git
2. Provide a toolchains.xml for JDK8 OR comment out all uses of toolchains in pom.xml
3. Invoke ./mvnw --no-transfer-progress -Prelease -Drevision=1.0.1 deploy

Now inspect the pom files found in target/staging-deploy. The consumer pom shows

  <groupId>io.github.helpermethod</groupId>
  <artifactId>zip-forge</artifactId>
  <version>1.0.1</version>
  <name>zip-forge</name>

while the build pom shows

    <groupId>io.github.helpermethod</groupId>
    <artifactId>zip-forge</artifactId>
    <version>${revision}</version>

    <name>${project.artifactId}</name>

which means properties were not interpolated, the source pom appears to be copied "as is" to be set as the build pom.

[aalmiray]

Following a discussion at the Maven slack, build poms should be skipped from maven central rules checks for the time being. Pomchecker can't do this as the change can only be detected by looking at the filename and the checker does not have access to it. Filed #1653

[helpermethod]

Thanks alot for revisiting the topic!