Guillaume Nodet opened MNG-8527 and commented

The consumer POM has been disabled in RC-2 (see MNG-8393) for 4.0.0 models.
I think it needs to be enabled again.

But there are a few things to fix:

• some properties (including CI-friendly) may leak through from consumer to dependency POM (see MNG-8523)
• the consumer pom flattens and inline all properties, which may be a problem if the property can be modified by a profile (javafx use case)
• the flattening process also makes all poms much more heavy as they usually convey lots of (previously inherited) data such as managed dependencies.

For the leak, this happens if the property is not actually defined as a property in the pom. It may come from a Maven user property. In such case, the property value won't be in the installed POM (when not using consumer POM), which means it can be modified by a user property from the requesting POM.
This is also related to profile activation, which may be activated or deactivated using user or system properties (including OS data which can be overridden from CLI).

Affects: 4.0.0-rc-2

Issue Links:

• MNG-8464 [Regression] Maven 4-rc-2 breaks Maven ShrinkWrap Resolvers
  ("fixes")

• MNG-8393 Maven consumer POM transformation should be applied only if built model is greater than 4.0.0

• MNG-8523 User properties should override model properties in the model

Remote Links:

• GitHub Pull Request #2058
  

1 votes, 3 watchers