gnodet commented on PR #13078: URL: https://github.com/apache/maven/pull/13078#issuecomment-5584474061
@cstamas The root cause is the tracking key function change from `nid` to `nid_hurl` in commit 339161b (f013). All existing `_remote.repositories` entries use ID-only keys (e.g. `artifact>central=`), but the new resolver looks for URL-qualified keys (`artifact>central-<sha1>=`). No match → every cached artifact appears "present but unavailable" → re-download from the IT's fake repos → 💥 This affects all 9 IT jobs (4229 test failures, 507 unique test classes on ubuntu/JDK26 alone). The `existenceCheckRelabel` change (f005) is secondary — even with the old existence-check behavior, the tracking key mismatch would cause failures because the fake repos can't serve the artifacts either way. Fix PR: https://github.com/apache/maven-resolver/pull/2133 — adds a backward-compatible fallback in `applyTracking()`: when the `nid_hurl` lookup misses, tries the system-wide key function (`nid`) as fallback. If the legacy key matches, the artifact is accepted with a debug log. The entry gets upgraded to `nid_hurl` on next download. Security intent of f013 is preserved for new entries. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
