maven tries to retrieve wrong snapshot version from repository because of bad maven-metadata.xml

Question

I'm using maven to fetch dependencies from our company's internal repositories. We use Artifactory. Everything works ok, but sometimes I have a recurring problem. After mvn -U clean compile I get an error.

Could not resolve dependencies for project company_groupId:company_dependency-articfactId:jar:0.0.1-SNAPSHOT: Could not find artifact company_groupId:company_dependency-articfactId:jar:2.0.17-20210429.123648-56 in snapshots2 (https://company.repository/snapshots)

When I look which jars repository actually contains, it appears it has 3 files in company_dependency-articfactId/0.0.1-SNAPSHOT

maven-metadata.xml                                       
company_dependency-articfactId-2.0.17-20210430.091957-56.jar   
company_dependency-articfactId-2.0.17-20210430.091957-56.pom 

So, maven searches for date 20210429 and what repository actually contains is date 20210430.

I thought maybe something removes dependencies, but the I looked inside maven-metadata.xml. Comments added for better understanding.

<?xml version="1.0" encoding="UTF-8"?>
<metadata modelVersion="1.1.0">
  <groupId>company_dependencyId</groupId>
  <artifactId>company_dependency-articfactId</artifactId>
  <version>2.0.17-SNAPSHOT</version>
  <versioning>
    <snapshot>
      <timestamp>20210430.091957</timestamp> <!-- ok version -->
      <buildNumber>56</buildNumber>
    </snapshot>
    <lastUpdated>20210430092512</lastUpdated>
    <snapshotVersions>
      <snapshotVersion>
        <extension>jar</extension>
        <value>2.0.17-20210429.123648-56</value> <!-- WRONG version -->
        <updated>20210429123648</updated>
      </snapshotVersion>
      <snapshotVersion>
        <extension>pom</extension>
        <value>2.0.17-20210430.091957-56</value> <!-- ok version -->
        <updated>20210430091957</updated>
      </snapshotVersion>
    </snapshotVersions>
  </versioning>
</metadata>

As you can see, jar version of snapshot actually points to the wrong jar, which doesn't exist. I looked at other dependencies and they're ok. So it's not something, which happens to all artifacts at a specific date.

I've no idea what could have caused this. Maybe somebody has already encountered such an issue?

Also I have couple of specific questions.

1. Could this mismatch between pom and jar versions of snapshots occur naturally? Like a script, which uploads next version for pom, but not for jar?

2. Could it be some kind of an error, when we have already uploaded pom, but couldn't upload jar for some reason? I mean it probably could happen, but is it reasonable to think that actually happens regularly?

3. Maybe it's a normal thing to upload pom and jar separately?

I haven't experienced anything like that before, so any help is much appreciated.

Answer 1

There's a couple of bugs in Artifactory, which could have caused this. For example https://www.jfrog.com/jira/browse/RTFACT-21321 https://www.jfrog.com/jira/browse/RTFACT-6514 or https://www.jfrog.com/jira/browse/RTFACT-21321 .

The problem could be solved by recreating metadata as J Fabian Meier suggested.

Answer 2

Got same problem. After some research it seams to be a known & already fixed bug https://issues.apache.org/jira/browse/MNG-6754 .

Upgrading your maven should fix it.