Can't download SNAPSHOT version of maven artifacts

[nicholas.boltralik_3634]

I have a few snapshot dependencies that I want to add to a maven feed. After I add them though, my application can't download them. I can't manually download them through the web page either. It just gives me a "File not found" error.

Steps to reproduce:
Upload any .pom and .jar file with a version in the .pom like so
<version>1.10-SNAPSHOT</version>
to a maven feed. You should see the correct file sizes in bytes indicating that they were properly uploaded
Try to download either the .pom or .jar. You should be directed to a page that says "File not found."

If its relevant, there is also a feed setup to mirror the main one.

Does anyone know how to solve this?

[rhessinger]

Hi @nicholas-boltralik_3634,

What version of ProGet are you running?

Thanks,
Rich

[nicholas.boltralik_3634]

We are on Version 5.3.7 (Build 12)

[nicholas.boltralik_3634]

If its relevant, there is also a feed setup to mirror the main one.

This is actually not the case, I was mistaken

[atripp]

Hello;

ProGet does support SNAPSHOT versioning, and when we test it, there's no problem. So I'm guessing it might be a problem with your POM file, repository configuration, or naming conventions?

They are a bit complex to get right, and the conventions have to be perfect; https://maven.apache.org/guides/getting-started/index.html#What_is_a_SNAPSHOT_version

[nicholas.boltralik_3634]

I can recreate the error with a .pom like below. This appears to follow the naming conventions.

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

	<modelVersion>4.0.0</modelVersion>
	
	<parent>
		<groupId>com.test</groupId>
		<artifactId>test-parent</artifactId>
		<version>2.2.0-SNAPSHOT</version>
	</parent>

	<name>libToolkit</name>
	<artifactId>Toolkit</artifactId>
	<packaging>jar</packaging>

</project>

The file is named Toolkit-2.2.0-SNAPSHOT.pom. Does it matter that 'SNAPSHOT' is in the file name?
If not, what repository settings might be causing this?

Thanks,
Nick

[atripp]

Hi Nik,

I can confirm that I got the same error message when I created a snapshot POM file, and tried to download it:

<project>
  <modelVersion>4.0.0</modelVersion>
 
  <groupId>com.mycompany.app</groupId>
  <artifactId>my-app</artifactId>
  <version>2-SNAPSHOT</version>
</project>

However, this works:

<project>
  <modelVersion>4.0.0</modelVersion>
 
  <groupId>com.mycompany.app</groupId>
  <artifactId>my-app</artifactId>
  <version>1</version>
</project>

However, I found the code where this was happening, and it seems to have always been working this way? I don't really get how SNAPSHOT works, but there seems to be some special handling with SNAPSHOT that I need to research some more. I'll follow-up once I learn more

[nicholas.boltralik_3634]

@atripp Alright, Thank you!

[atripp]

@nicholas-boltralik_3634 I investigated this further, and the behavior seems to have existed since 5.2 and earlier.

I'm not totally sure how works Maven, but I'm almost certain you're not supposed to create an artifact with a version that has -SNAPSHOT in it. Instead, the -SNAPSHOT seems to be intended for use inside of a <dependency> only.

if your project depends on a software component that is under active development, you can depend on a snapshot release, and Maven will periodically attempt to download the latest snapshot from a repository when you run a build. Similarly, if the next release of your system is going to have a version “1.8,” your project would have a “1.8-SNAPSHOT” version until it was formally released.

For example , the following dependency would always download the latest 1.8 development JAR of spring:

 <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring</artifactId>
        <version>1.8-SNAPSHOT”</version>
    </dependency>

https://stackoverflow.com/a/45082572

My understanding of how the server logic works, if you request a version with -SNAPSHOT in it, then the latest version is returned. In other words, -SNAPSHOT is not a real version, it's just something the server uses t send back the latest version. And since there is no latest version, you get an error.

It seems to be a problem to allow a version called -SNAPSHOT to be uploaded, because then it's ambiguous. When you ask for -SNAPSHOT do you want the version named that, or the latest version, etc.

To be honest this is all confusing to me... I'm wondering, why do you create a -SNAPSHOT version?

[nicholas.boltralik_3634]

you're not supposed to create an artifact with a version that has -SNAPSHOT in it. Instead, the -SNAPSHOT seems to be intended for use inside of a <dependency> only

I think if you specify a dependency on a snapshot you would have to have a corresponding artifact that declares its own version as snapshot. For example, if I had in my local repo a 1.8 release version and a 1.8 snapshot I would need some sort of identifier in the snapshot artifact to indicate that it is a snapshot so that when maven looks to resolve a 1.8-SNAPSHOT dependency it knows which of those two is the latest.
That's how it is done here with the data-service pom.

My understanding of how the server logic works, if you request a version with -SNAPSHOT in it, then the latest version is returned. In other words, -SNAPSHOT is not a real version, it's just something the server uses t send back the latest version. And since there is no latest version, you get an error.

It seems to be a problem to allow a version called -SNAPSHOT to be uploaded, because then it's ambiguous. When you ask for -SNAPSHOT do you want the version named that, or the latest version, etc.

So if I remove the SNAPSHOT tag from the poms that I upload, then the server would be able to supply them when a request for the SNAPSHOT version comes in?

As to why the snapshots exist, this is an inherited code base and the previous maintainers left it in that state.

[nicholas.boltralik_3634]

Just tested this:

So if I remove the SNAPSHOT tag from the poms that I upload, then the server would be able to supply them when a request for the SNAPSHOT version comes in?

Since dependencies still refer to this as a snapshot version the request looks like this

https://<my-feed>/com/test/Toolkit/2.2.0-SNAPSHOT/Toolkit-2.2.0-SNAPSHOT.pom

and it fails to find the file.

[nicholas.boltralik_3634]

@atripp Do you have any advice on how to continue from here?

[atripp]

@nicholas-boltralik_3634 very sorry on the slow response, we were internally discussing and tracking this, but I guess I didn't update you here.

We will target to make a software change in PG-1814, and hopefully get this working in the next or following maintenance release.

[nicholas.boltralik_3634]

@atripp alright, Thank you!

[atripp]

Hello, this has finally been scheduled for 5.3.13, which is shipping tomorrow. It addresses only this specific test case, so please let us know if you're spotting other errors.