eclipse-repository pulls dependencies from maven central instead of p2?

[jonahgraham]

When build a project (Eclipse EPP, e.g. mvn clean verify dependency:tree -Pepp.package.embedcpp) I see some dependencies of packaging eclipse-repository modules are being pulled from Maven Central instead of the p2 repo that I have listed in <repositories>.

Is this expected / is this what is happening?

e.g. dependency:tree is showing:

[INFO] --- dependency:2.8:tree (default-cli) @ epp.package.embedcpp ---
[WARNING] Parameter 'localRepository' is deprecated core expression; Avoid use of ArtifactRepository type. If you need access to local repository, switch to '${repositorySystemSession}' expression and get LRM from it instead.
[INFO] org.eclipse.epp:epp.package.embedcpp:eclipse-repository:4.29.0-SNAPSHOT
[INFO] +- org.bouncycastle:bcpg-jdk18on:jar:1.76:compile
[INFO] +- org.bouncycastle:bcprov-jdk18on:jar:1.76:compile
[INFO] +- p2.eclipse.plugin:org.eclipse.justj.openjdk.hotspot.jre.full.linux.x86_64:eclipse-plugin:17.0.8.v20230801-1951:system
[INFO] +- org.bouncycastle:bcpkix-jdk18on:jar:1.76:compile
[INFO] +- org.bouncycastle:bcutil-jdk18on:jar:1.75:compile
[INFO] +- org.slf4j:slf4j-api:jar:2.0.7:compile
[INFO] +- org.apache.aries.spifly:org.apache.aries.spifly.dynamic.bundle:jar:1.3.6:compile
--snip--

and when a build is running I can see things like this:

Downloading from central: https://repo.maven.apache.org/maven2/org/mandas/docker-client/5.2.2/docker-client-5.2.2.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/mandas/docker-client/5.2.2/docker-client-5.2.2.pom (18 kB at 228 kB/s)

I'm concerned this indicates I could be building incorrectly and pulling dependencies from Maven Central instead of the p2 simrel repo.

[laeubi]

Is this expected

Yes

is this what is happening?

No, the dependencies are pulled from P2 mapped to original maven coordinates and then injected into the maven model but Tycho still use the P2 variant.

I'm concerned this indicates I could be building incorrectly and pulling dependencies from Maven Central instead of the p2 simrel repo.

It would only be incorrect if simrel is lying to P2 and the artifacts are in fact different, if not it actually don't make a difference from what host an artifact is downloaded.

[jonahgraham]

Thanks for the answer.

Just to confirm my understanding - if the p2 repo has bundle version 1.1.0 that can satisfy a dependency (e.g. [1.1,2.0)) and maven central has 1.1.1, is there anyway for the 1.1.1 version to end up in my product?

[laeubi]

No Tycho resolves always against P2 and only after that check if it can map it to a true maven artifact.

[HannesWell]

Just out of curiosity, what's the motivation to do that and not just fetch it from the p2-repo as usual?
To benefit from the local .m2 cache?

[laeubi]

It is mostly for tools like dependency:tree to show real artifacts instead of synthetic p2 system scoped items. As said Tycho always uses the P2 artifacts.

[jonahgraham]

I ended up raising #2881 as this behaviour seems to have broken the EPP build.