Issue with imported scope poms (spring bom io dependency issue)

Question

My company policy restricts us from downloading thirdparty artifacts from public repositories (maven_central, spring-io etc) We use Nexus as a repository manager which hosts all the artifacts that are approved by our company policy.

We are trying to use io-platform bom pom in our project to manage all spring dependencies.

We have uploaded all boms and its dependencies in our company repository. Verified also, everything is there in the company repos.
In my settings.xml all repositories (hosted by company) are properly mentioned. But somehow for spring-framework-bom project maven searches only in central even if it is disabled in settings.xml.It should ideally search in our company repositories first.

We are getting the below exception. Exception trace: org.apache.maven.reactor.MavenExecutionException: POM 'org.springframework:spring-framework-bom' not found in repository: Unable to download the artifact from any repository org.springframework:spring-framework-bom:pom:4.0.6.RELEASE from the specified remote repositories: central (http://repo1.maven.org/maven2)

Answer 1

This problem comes when you have pom/artifact defined with import scope in your other pom.

Imported dependencies basically looses repository information and they try to search dependencies in maven central .

Trick is to mirror maven central repository with your companies repository. So in case of imported dependency it will search in companies repository rather than default maven central.

Hope this helps.

Answer 2

It's a bug. This is the proposed solution:

IMO, using the stated workaround (adding the custom repository to the POM that has the scope == import dependency) is probably the safest way to go

It works at least in Maven 3.3.9. Probably already earlier.