Maven settings.xml that uses Artifactory, and restricts snapshot repository use

Hopefully this information is useful for other people who have Maven
projects but have to use other libraries and Maven plugins that are
still in the pre-release stage.

We are using Artifactory at work as a local repository proxy for Maven.

We also have a project that makes use of some snapshot libraries for
the CXF project, which is currently under incubation in Apache.

Previously, we were just using a <mirrors> but this resulted in Maven
getting its metadata settings both from the central repository and the
snapshot locations. We ended up getting snapshots of Maven plugins
that we never really wanted, as Maven would get plugin metadata from
both the repository types, and of course, the latest version would be
the snapshot ones.

To remedy this, we had to change settings.xml so that the only time
the Apache snapshot plugin repositories are used is in the projects
that require the CXF plugin and associated dependencies. The important
thing is to make sure the id element in the repository settings match
the repository setting id in the project pom.xml. The pom.xml settings
can still point to the live, non-proxied repository, but Maven will
first look at the id in that pom file and see if there is an entry
with the same id in the settings.xml

<settings>

<!-- uncomment this section and comment out the profiles section if
the Artifactory (local maven repository) is broken -->

<!--

<proxies>
<proxy>
<active>true</active>
<protocol>http</protocol>
<host>company.proxy</host>
<port>8080</port>
</proxy>
</proxies>
-->

<profiles>
<profile>
<id>default</id>
<activation>
<activeByDefault>true</activeByDefault>
</activation>

<repositories>
<repository>
<id>central</id>
<url>http://internal.company.proxy:7070/artifactory/repo1
<snapshots>
<enabled>false</enabled>
</snapshots>
</repository>
<repository>
<id>snapshots</id>

<url>http://internal.company.proxy:7070/artifactory/snapshots-only
<releases>
<enabled>false</enabled>
</releases>
</repository>

<repository>
<id>everything-else</id>

<url>http://internal.company.proxy:7070/artifactory/releases
<snapshots>
<enabled>false</enabled>
</snapshots>
</repository>

<!-- used by SomeWebService/pom.xml The id here
*must* match what's in the pom file -->
<repository>
<id>apache.org</id>

<url>http://internal.company.proxy:7070/artifactory/apache-m2-snapshots
<snapshots>
<enabled>true</enabled>
</snapshots>
</repository>

<!-- used by SomeWebService/pom.xml The id here
*must* match what's in the pom file -->
<repository>
<id>apache.incubating.releases</id>

<url>http://internal.company.proxy:7070/artifactory/apache-m2-incubating
<snapshots>
<enabled>true</enabled>
</snapshots>
</repository>

</repositories>

<pluginRepositories>

<pluginRepository>
<id>central</id>
<url>http://internal.company.proxy:7070/artifactory/repo1
<snapshots>
<enabled>false</enabled>
</snapshots>
</pluginRepository>
<pluginRepository>
<id>snapshots</id>

<url>http://internal.company.proxy:7070/artifactory/snapshots-only
<releases>
<enabled>true</enabled>
</releases>
</pluginRepository>

<!-- used by SomeWebService/pom.xml The id here
*must* match what's in the pom file -->
<pluginRepository>
<id>apache-plugin-incubating</id>

<url>http://internal.company.proxy:7070/artifactory/apache-m2-incubating
<releases>
<enabled>true</enabled>
</releases>
</pluginRepository>

</pluginRepositories>

</profile>

</profiles>

Maven updates its plugin metadata then says it can't find the plugin - WTF?

Trying to generate the IntelliJ project files for a Maven 2 project.
Then I got an error:

mvn idea:idea
[INFO] Scanning for projects...
[INFO] Searching repository for plugin with prefix: 'idea'.
[INFO] artifact org.apache.maven.plugins:maven-idea-plugin: checking
for updates from central
[INFO] ------------------------------------------------------------------------
[ERROR] BUILD ERROR
[INFO] ------------------------------------------------------------------------
[INFO] Error building POM (may not be this project's POM).

Project ID: org.apache.maven.plugins:maven-idea-plugin

Reason: Error getting POM for
'org.apache.maven.plugins:maven-idea-plugin' from the repository:
Failed to resolve artifact, possibly due to a repository list that is
not appropriately equipped for this artifact's metadata.
org.apache.maven.plugins:maven-idea-plugin:pom:2.2-SNAPSHOT

from the specified remote repositories:
central (http://repo1.maven.org/maven2)

Now I look in my Maven repository, in the maven-idea-plugin directory, in

\.m2\repository\org\apache\maven\plugins\maven-idea-plugin

and I find the maven-metadata-central.xml which has this:

<?xml version="1.0"?><metadata>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-idea-plugin</artifactId>
<versioning>
<latest>2.2-SNAPSHOT</latest>
<release>2.1</release>
<versions>
<version>2.0-beta-1</version>
<version>2.0</version>
<version>2.1</version>
<version>2.0-beta-2-SNAPSHOT</version>
<version>2.0-SNAPSHOT</version>
<version>2.1-SNAPSHOT</version>
<version>2.2-SNAPSHOT</version>
</versions>
<lastUpdated>20070716221242</lastUpdated>
</versioning>
</metadata>

But when I look in the location:

http://repo1.maven.org/maven2/org/apache/maven/plugins/maven-idea-plugin/

And get the maven-metadata.xml, it has:

<metadata>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-idea-plugin</artifactId>

<versioning>
<latest>2.1</latest>
<release>2.1</release>

<versions>
<version>2.0-beta-1</version>
<version>2.0</version>
<version>2.1</version>
</versions>

<lastUpdated>20070604220104</lastUpdated>

</versioning>

</metadata>

The only possible reason I can think of for this happening is that
Maven is getting the metadata from somewhere else. We are using
Artifactory and one of the repositories we have set up is an entry
pointing to http://people.apache.org/repo/m2-incubating-repository.
The artifactory.config.xml contains this:

<remoteRepository>
<key>apache-m2-incubating</key>
<handleReleases>true</handleReleases>
<handleSnapshots>true</handleSnapshots>
<excludesPattern>org/artifactory/**,org/jfrog/**,au/com/company/**</excludesPattern>
<url>http://people.apache.org/repo/m2-incubating-repository
<proxyRef>work-proxy</proxyRef>
</remoteRepository>

Now in this repository, there is a directory for maven-idea plugin, at

http://people.apache.org/repo/m2-snapshot-repository/org/apache/maven/plugins/maven-idea-plugin/

and there is a file
http://people.apache.org/repo/m2-snapshot-repository/org/apache/maven/plugins/maven-idea-plugin/maven-metadata.xml
that contains:

−
<metadata>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-idea-plugin</artifactId>
<version>2.0-beta-2-SNAPSHOT</version>
<versioning>
<latest>2.2-SNAPSHOT</latest>
<versions>
<version>2.0-beta-2-SNAPSHOT</version>
<version>2.0-SNAPSHOT</version>
<version>2.1-SNAPSHOT</version>
<version>2.2-SNAPSHOT</version>
</versions>
<lastUpdated>20070716221242</lastUpdated>
</versioning>
</metadata>

Now the strange thing is that this info is not exactly the same as
what's in my local repository. So it looks like the
maven-metadata-central.xml I have for maven-idea-plugin did *not* come
from this location. So where did it come from? I should probably add
to the exclusion list for the above repository so it doesn't try and
get maven plugins from there. But from the error message I got, it
looks like it only goes to the central repository at repo1.maven.org
for plugin updates. If that's the case, why does it seem to go
somewhere else for it's plugin updates?

What the hell is Maven actually doing?