This issue has been created
There is 1 update.
 
 
XWiki Commons / cid:jira-generated-image-avatar-7d9a2892-218d-4025-ad61-64bc50603001 XCOMMONS-3821 Open

Maven repository release/snapshot policies are lost when an extension is resolved through an XWiki extension repository

 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-ed501216-150f-4ccf-8e13-02eda43c5028 Thomas Mortagne created this issue on 05/Oct/26 17:28
 
Summary: Maven repository release/snapshot policies are lost when an extension is resolved through an XWiki extension repository
Issue Type: cid:jira-generated-image-avatar-7d9a2892-218d-4025-ad61-64bc50603001 Bug
Affects Versions: 18.1.0-rc-1
Assignee: Unassigned
Components: Extension, Repository
Created: 05/Oct/26 17:28
Priority: cid:jira-generated-image-static-major-3c7c01de-f044-4a4f-a334-594ced5d47f1 Major
Reporter: Thomas Mortagne
Description:

XCOMMONS-3562 made Extension Manager respect the <releases> / <snapshots> enabled flags of the repositories declared in Maven poms, by storing them as maven.release / maven.snapshot properties on the ExtensionRepositoryDescriptor of the extension (and its dependencies), and skipping a repository when the searched version type is not allowed.

But these properties are only available when the extension metadata is read directly from the Maven pom (or from the local extension descriptor). When the extension comes from an XWiki extension repository (e.g. extensions.xwiki.org) the properties are lost:

  • the REST model ExtensionRepository (xwiki.rest.extension.model.xsd) only contains id, uri and type
  • XWikiExtension#toExtensionRepositoryDescriptor() always passes null properties

A repository without properties is considered as allowing both releases and snapshots, so, for an extension resolved through extensions.xwiki.org, a snapshot-only repository like jvnet-nexus-snapshots (declared with releases disabled by net.java:jvnet-parent) is still used to search for release dependencies, which produces useless requests and errors in the logs like:

Unexpected error when trying to find extension dependency [grizzly-http 2.3.25] in repository [jvnet-nexus-snapshots:maven:https://maven.java.net/content/repositories/snapshots]: CertificateExpiredException: NotAfter: Thu Apr 02 02:59:59 EEST 2026

(see XWIKI-24190)

Fixing it requires:

  • adding the repository properties to the REST model ExtensionRepository
  • reading them in XWikiExtension#toExtensionRepositoryDescriptor()
  • filling them on the server side (xwiki-platform repository server), which will also require an XWIKI issue
 
 

1 update

 
cid:jira-generated-image-avatar-ed501216-150f-4ccf-8e13-02eda43c5028 Changes by Thomas Mortagne on 05/Oct/26 17:29
 
Description: XCOMMONS-3562 made Extension Manager respect the {{<releases>}} / {{<snapshots>}} {{enabled}} flags of the repositories declared in Maven poms, by storing them as {{maven.release}} / {{maven.snapshot}} properties on the {{ExtensionRepositoryDescriptor}} of the extension (and its dependencies), and skipping a repository when the searched version type is not allowed.

But these properties are only available when the extension metadata is read directly from the Maven pom (or from the local extension descriptor). When the extension comes from an XWiki extension repository (e.g. extensions.xwiki.org) the properties are lost:
* the REST model {{ExtensionRepository}} ({{xwiki.rest.extension.model.xsd}}) only contains {{id}}, {{uri}} and {{type}}
* {{XWikiExtension#toExtensionRepositoryDescriptor()}} always passes {{null}} properties

A repository without properties is considered as allowing both releases and snapshots, so, for an extension resolved through extensions.xwiki.org, a snapshot-only repository like {{jvnet-nexus-snapshots}} (declared with releases disabled by {{net.java:jvnet-parent}}) is still used to search for release dependencies, which produces useless requests and errors in the logs like:
{noformat}
Unexpected error when trying to find extension dependency [grizzly-http 2.3.25] in repository [jvnet-nexus-snapshots:maven:https://maven.java.net/content/repositories/snapshots]: CertificateExpiredException: NotAfter: Thu Apr 02 02:59:59 EEST 2026
{noformat}
(see XWIKI-24190)

Fixing it requires:
* adding the repository properties to the REST model {{ExtensionRepository}}
* reading them in {{XWikiExtension#toExtensionRepositoryDescriptor()}}
* filling them on the server side (xwiki-platform repository server)
, which will also require an XWIKI issue