How to Set Order of Repositories in Maven Settings.Xml

How to set order of repositories in Maven settings.xml

As far as I know, the order of the repositories in your pom.xml will also decide the order of the repository access.

As for configuring repositories in settings.xml, I've read that the order of repositories is interestingly enough the inverse order of how the repositories will be accessed.

Here a post where someone explains this curiosity:

http://community.jboss.org/message/576851

Order of maven repositories in settings.xml

The order of the repository inside the settings was not clearly specified in Maven 2, but starting with Maven 3 (and the fix of of MNG-4400), the repositories are always tried in their declaration order in the settings.

What can happen, and what is likely the cause of your problem, is that Maven tries a repository, fails in doing so, and stores in your local repository the fact that it tried and failed. This results in the creation of .lastUpdated files in your local repository, storing this information. The consequence is that Maven will not re-try to download the dependency from a repository where it knows the download failed in the past. Thus, when you start a command and the project requires an artifact not present in your local repository, Maven will still try the repositories in their order of declaration, but it will skip the ones it knows already failed.

But you can force it to bypass this mechanism by passing the -U flag on the command line. It forces Maven to update the releases and snapshots dependencies, without looking into .lastUpdated files. This way, it will re-try every active remote repositories.

What is the repository order that is considers by Maven when it tries to download plugins?

I did the following to determine the order in which Maven considers the repository order:

• I updated the URLs of all the repository/mirror settings in all the XML files to be invalid Maven repos in order to force Maven to fail
• I ran mvn compile

The following results are assuming that a certain dependency was never downloaded/registered in the local cache ~/.m2/repository (i.e. it was not cached or did not fail previously using other repository). If you have an entry for a certain dependency in the local cache, Maven will reuse that cached entry (which saves also the initial source repository) to try and fetch it again.

This is what Maven tries when NO mirrors are configured:

Downloading from settings-repo1: http://settings-repo1.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from settings-repo2: http://settings-repo2.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from pom-child-repo1: http://child-repo1.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from pom-child-repo2: http://child-repo2.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from pom-parent-repo1: http://parent-repo1.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from pom-parent-repo2: http://parent-repo2.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom

and when there ARE mirrors configured:

Downloading from settings-repo1: http://settings-repo1.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from settings-repo2: http://settings2.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from settings-mirror1: http://settings-mirror1.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from settings-mirror2: http://settings-mirror2.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from pom-parent-repo1: http://parent-repo1.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from pom-parent-repo2: http://parent-repo2.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom

So the order must be:

• settings.xml
• current project's pom.xml
• parent project's pom.xml

If there are any mirrors configured, they will just replace the corresponding repositories in the original list identified by the mirrorOf element. If the mirrorOf expression identifies multiple repositories, only the first occurrence (in the Maven original order without configured mirrors) will be tried. For example, if there is a mirror (e.g. settings-mirror1) configured for: <mirrorOf>pom-parent-repo2,pom-child-repo1</mirrorOf> the repository search order will be:

Downloading from settings-repo1: http://settings-repo1.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from settings-repo2: http://settings-repo2.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from settings-mirror1: http://settings-mirror1.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from pom-child-repo2: http://child-repo2.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from pom-parent-repo1: http://parent-repo1.org/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/httpcomponents/httpclient1/4.5.6/httpclient1-4.5.6.pom

As for the repositories declared in the dependency POM files, I think one should not care about them. If you have a dependency this needs to be available in one of the declared repositories (settings, parent pom, pom), otherwise the build will fail (even if you have that dependency downloaded and cached previously by another project (sub-dependency or not).

How maven handle multiple repository configurations?

How will maven handle these repos when downloading artifacts? Will it
search by the declaration order?

Order of declaration as part of the merged settings (see next answer). I have found this JIRA ticket providing further details.

Besides the explicitly declared ones, will maven still check the
default central repo at http://repo.maven.apache.org/maven2/?

Yes, as it will be provided by the Maven super POM, implicit parent of all Maven Pom (here an official example), unless specified in your settings.xml (if you override the repository id specified in the super POM). You can use the Maven Help Plugin to get the effective settings Maven will apply to your build and the effective pom maven will actually (effectively) run.

As documented here, the repositories element is inherited.

If something cannot be found within the explicitly configured repo,
will maven fallback to the default central repo?

As above. Moreover, you could also influence this mechanism via any configured Maven mirror. You could, for instance, redirect Maven to your company repository (see below) instead of looking up on the default one.

Is it good to use multiple repos? I am kind of worried about
inconsistency.

You probably don't need many configured repositories, but you might need more than one if the dependencies you are looking for are not provided by the default repository. A good approach would be to have an enterprise Maven repository (i.e. Artifactory, Nexus) and make your local settings only point to it. Then, configure the internal Maven repository to point to other repositories, in a centralized (and governed) manner.

---

Related Topics