Maven metadata in central wrong for project

[craigday]

Central proxy is currently returning maven metadata that does not contain current versions of Guice. Beaking all of our builds:

https://repo.maven.apache.org/maven2/com/google/inject/guice/maven-metadata.xml

<?xml version="1.0" encoding="UTF-8"?>
<metadata modelVersion="1.1.0">
  <groupId>com.google.inject</groupId>
  <artifactId>guice</artifactId>
  <versioning>
    <latest>4.0-beta5</latest>
    <release>4.0-beta5</release>
    <versions>
      <version>1.0</version>
      <version>2.0</version>
      <version>2.0-no_aop</version>
      <version>3.0-rc2</version>
      <version>3.0-rc3</version>
      <version>3.0</version>
      <version>4.0-beta</version>
      <version>4.0-beta4</version>
      <version>4.0-beta5</version>
    </versions>
    <lastUpdated>20141017162124</lastUpdated>
  </versioning>
</metadata>

[craigday]

I picked up a similar issue a few months back with another Google repo that ended up being a Sonatype issue.

Related issue:
protocolbuffers/protobuf#6919

Sonatype issue:
https://issues.sonatype.org/browse/OSSRH-53287

Maybe it's related. Maybe not.

[craigday]

guice-parent is also affected:

https://repo.maven.apache.org/maven2/com/google/inject/guice-parent/maven-metadata.xml

<?xml version="1.0" encoding="UTF-8"?>
<metadata modelVersion="1.1.0">
  <groupId>com.google.inject</groupId>
  <artifactId>guice-parent</artifactId>
  <versioning>
    <latest>4.0-beta5</latest>
    <release>4.0-beta5</release>
    <versions>
      <version>1.0</version>
      <version>2.0</version>
      <version>2.0-no_aop</version>
      <version>3.0-rc2</version>
      <version>3.0-rc3</version>
      <version>3.0</version>
      <version>4.0-beta</version>
      <version>4.0-beta4</version>
      <version>4.0-beta5</version>
    </versions>
    <lastUpdated>20141017162125</lastUpdated>
  </versioning>
</metadata>

and the extensions:

https://repo.maven.apache.org/maven2/com/google/inject/extensions/guice-assistedinject/

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>com.google.inject.extensions</groupId>
  <artifactId>guice-assistedinject</artifactId>
  <versioning>
    <latest>4.0-beta5</latest>
    <release>4.0-beta5</release>
    <versions>
      <version>3.0-rc2</version>
      <version>3.0-rc3</version>
      <version>3.0</version>
      <version>4.0-beta</version>
      <version>4.0-beta4</version>
      <version>4.0-beta5</version>
    </versions>
    <lastUpdated>20140924213500</lastUpdated>
  </versioning>
</metadata>

but the bom looks fine:

https://repo.maven.apache.org/maven2/com/google/inject/guice-bom/maven-metadata.xml

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>com.google.inject</groupId>
  <artifactId>guice-bom</artifactId>
  <versioning>
    <latest>4.2.3</latest>
    <release>4.2.3</release>
    <versions>
      <version>4.0</version>
      <version>4.1.0</version>
      <version>4.2.0</version>
      <version>4.2.1</version>
      <version>4.2.2</version>
      <version>4.2.3</version>
    </versions>
    <lastUpdated>20200319201309</lastUpdated>
  </versioning>
</metadata>

[mcculls]

I've opened https://issues.sonatype.org/browse/OSSRH-56420 to request a rebuild of the metadata on central to hopefully get things back in sync.

BTW, what build tool are you using and how are you describing your Guice dependencies? The incomplete maven metadata shouldn't affect builds if you use a specific dependency version in your project, which is recommended for reproducible builds.

[mcculls]

OK, metadata has been updated on central

[craigday]

We use nexus as a maven central proxy/mirror. It looks like it relies upon the metadata from the upstream to define exactly what artifacts/versions exist for a given dependency. The workaround, while this was busted, was to use a different mirror.

[mcculls]

Nexus itself doesn't rely on maven metadata to filter upstream artifact requests, but something in the build pipeline probably relied on knowing the 'latest' version (disclaimer: I work on Nexus.)

Anyway, central now has the right metadata.

[craigday]

Thanks for letting us know. Something must not be quite right somewhere in our dependencies.