Dependency resolution on newly published artefacts

[Raymond Barlow]

Hi everyone,

I quite often publish new versions of libraries, to maven central, sonatype, etc.. and then go to use it in another app.

For the 1st haf hour, after I have published the artefact, SBT seems to not be able to resolve it. As an example, today I published version 1.0.88 of Clairvoyance. Once the build had finished and it had been published, I tried to use it from another app. using sbt update, I get output like this for the first half-hour or so.

$ sbt update
Picked up JAVA_TOOL_OPTIONS: -Dfile.encoding=UTF-8
[info] Loading global plugins from /Users/me/.sbt/0.13/plugins
[info] Loading project definition from /Users/me/dev/projects/boost/project
[info] Set current project to boost (in build file:/Users/me/dev/projects/boost/)
[info] Updating {file:/Users/me/dev/projects/boost/}root...
[info] Resolving com.github.rhyskeepence#clairvoyance-scalatest_2.10;1.0.88 ...
[warn] module not found: com.github.rhyskeepence#clairvoyance-scalatest_2.10;1.0.88
[warn] ==== local: tried
[warn] /Users/me/.ivy2/local/com.github.rhyskeepence/clairvoyance-scalatest_2.10/1.0.88/ivys/ivy.xml
[warn] ==== public: tried
[warn] https://repo1.maven.org/maven2/com/github/rhyskeepence/clairvoyance-scalatest_2.10/1.0.88/clairvoyance-scalatest_2.10-1.0.88.pom
[warn] ==== releases: tried
[warn] http://oss.sonatype.org/content/repositories/releases/com/github/rhyskeepence/clairvoyance-scalatest_2.10/1.0.88/clairvoyance-scalatest_2.10-1.0.88.pom
[warn] ==== Typesafe Releases: tried
[warn] http://repo.typesafe.com/typesafe/maven-releases/com/github/rhyskeepence/clairvoyance-scalatest_2.10/1.0.88/clairvoyance-scalatest_2.10-1.0.88.pom
[info] Resolving org.fusesource.jansi#jansi;1.4 ...
[warn] ::::::::::::::::::::::::::::::::::::::::::::::
[warn] :: UNRESOLVED DEPENDENCIES ::
[warn] ::::::::::::::::::::::::::::::::::::::::::::::
[warn] :: com.github.rhyskeepence#clairvoyance-scalatest_2.10;1.0.88: not found
[warn] ::::::::::::::::::::::::::::::::::::::::::::::


Now the weird thing is that, while SBT is telling me this, I can MANUALLY go to
http://oss.sonatype.org/content/repositories/releases/com/github/rhyskeepence/clairvoyance-scalatest_2.10/1.0.88/clairvoyance-scalatest_2.10-1.0.88.pom
and download the pom fine.

Eventually, when it does download (usually about half an hour), it downloads from maven:

[info] downloading https://repo1.maven.org/maven2/com/github/rhyskeepence/clairvoyance-scalatest_2.10/1.0.88/clairvoyance-scalatest_2.10-1.0.88.jar ...
[info] [SUCCESSFUL ] com.github.rhyskeepence#clairvoyance-scalatest_2.10;1.0.88!clairvoyance-scalatest_2.10.jar (915ms)
[info] downloading https://repo1.maven.org/maven2/com/github/rhyskeepence/clairvoyance-core_2.10/1.0.88/clairvoyance-core_2.10-1.0.88.jar ...
[info] [SUCCESSFUL ] com.github.rhyskeepence#clairvoyance-core_2.10;1.0.88!clairvoyance-core_2.10.jar (919ms)


1. Why can't sbt get the files successfully from sonatype when they actually seem to be there?

2. Why does it take so long?

Cheers,

Raymond

[Josh Suereth]

oss.sonatype.org is *NOT* the same as repo1.mavne.org.  There's about a half-hour delay between when you release and when your jar is propogated into the maven-central CDN.

Why does it take so long?  That's a question for sonatype, but 1/2 hour isn't unreasonable.  If you need it sooner, add the sonatype-releases resolver to your proejct to download it directly form the place you're uploading, rather than the CDN.

--
You received this message because you are subscribed to the Google Groups "simple-build-tool" group.
To unsubscribe from this group and stop receiving emails from it, send an email to simple-build-t...@googlegroups.com.
To post to this group, send email to simple-b...@googlegroups.com.
Visit this group at http://groups.google.com/group/simple-build-tool.
For more options, visit https://groups.google.com/d/optout.

[Raymond Barlow]

Yep, totally understand. 

I probably missed out 1 point (but it was implicit in the first log) that the sonatype-releases IS one of our resolvers:

resolvers ++= Seq("releases"           at "http://oss.sonatype.org/content/repositories/releases",

                  "Typesafe Releases"  at "http://repo.typesafe.com/typesafe/maven-releases/", [and a few others])

The SBT log even states that it TRIED a url and failed, where I do it myself manually using curl/wget/browser and it works fine. You can see in the log that I posted earlier, that it TRIED sonatype-releases (highlighted red below). I literally copy/paste the url that it logs to try it myself, and it works fine. Why does it not work fine with SBT?

Do I have to add the resolver somewhere else, or somehow else?

/Raymond

--
You received this message because you are subscribed to a topic in the Google Groups "simple-build-tool" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/simple-build-tool/k-AXncN7YpI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to simple-build-t...@googlegroups.com.

[Josh Suereth]

Interesting.  My only guess is that perhaps sonatype is looking at the user-agent and redirecting at their CDN.....

[Raymond Barlow]

Well, with a bit of wireshark/curl action, I've worked it out.

I was using the http version of the sonatype url. Sonatype was returning a 301 permanently moved to the HTTPS version of the URL.

Changing the resolver from 

http://oss.sonatype.org/content/repositories/releases to 

https://oss.sonatype.org/content/repositories/releases

Fixed it!

So, not an SBT problem at all. Thanks for your help.

Cheers,

Raymond

[Raymond Barlow]

Actually, SBT should probably have followed the 301... ?

[Josh Suereth]

On Thu, Sep 11, 2014 at 10:35 AM, Raymond Barlow <mrraymo...@gmail.com> wrote:

Actually, SBT should probably have followed the 301... ?

Hmm, yeah.   Maybe opena  ticket about that?   SBt should have followed it.

We did migrate (in the soon to be releases sbt 0.13.6) to https for all default resolvers.