repo.spring.io is missing `com.springsource.*` artifacts

[nmichaud2]

Not sure where to ask this, but it seems like some artifacts are no longer available on repo.spring.io. For example, this

• https://repo.spring.io/ui/native/plugins-release/com/fasterxml/com.springsource.com.fasterxml.classmate/0.5.4/com.springsource.com.fasterxml.classmate-0.5.4.jar
• https://mvnrepository.com/artifact/com.fasterxml/com.springsource.com.fasterxml.classmate/0.5.4

I know these are quite old but trying to find out if it's normal or not ?

[bclozel]

I think this can be traced back to https://spring.io/blog/2020/10/29/notice-of-permissions-changes-to-repo-spring-io-fall-and-winter-2020#how-to-use-repo-spring-io

/plugins-release has mostly been about mirroring other repositories, I don't know why mvnrepository.com only points to repo.spring.io as the main host for this artifact, maybe a library repackaged by SpringSource back in the days for some reason? I did not find the artifact on our Artifactory instance so I think this one's gone from our side.

As you can see in this blog post, we're tightening the rules around repo.spring.io and we're likely to increase this in the future.

Thanks!

[sbrannen]

I know these are quite old but trying to find out if it's normal or not ?

Yes, this is to be expected.

Those were artifacts repackaged by SpringSource to add OSGi metadata to third-party libraries for the SpringSource Enterprise Bundle Repository (EBR).

The SpringSource EBR was decommissioned over a decade ago.

Thus, you should not have any dependencies on artifacts with artifact IDs of the form com.springsource.<third-party artifact id>.

[nmichaud2]

Yes that's what we thought, but we only started getting errors today about the artifacts being missing. It might have been cached/stored on our artifactory for a while but we were trying to find out if there was a repository that still had those artifacts or not(we only have maven central as a remote repo that could potentially have resolved those). Seems like not !
Thanks