maven-2dependencies

How to specify a repository for a dependency in Maven

In projects with several dependencies and repositories, the try-and-error approach of Maven for downloading dependencies is a bit cumbersome and slow, so I was wondering if there is any way to set an specific repo for some declared dependencies.

For example, I want for bouncycastle to check directly BouncyCastle's Maven repo at http://repo2.maven.org/maven2/org/bouncycastle/ instead of official Maven.

Solution

  • Since Maven 3.9.0, Remote Repository Filtering can be used.

    This feature exists since several years but continue to be improved regularly. (so full feature is mainly available in maven4, heimdall could help for maven3)

    In your pom.xml you still declare your thirdparty repository

    <repositories>
    <repository>
        <id>thrirdpartyrepo</id>
        <url>https://...</url>
    </repository>
    ...
</repositories>

    Then you can put in your project root folder a .mvn/rrf named groupId-thrirdpartyrepo.txt containing artefact groupId you want to :

    org.thirdparty.lib

    And in a .mvn/maven.config file :

    -Daether.remoteRepositoryFilter.groupId.basedir=${session.rootDirectory}/.mvn/rrf/
-Daether.remoteRepositoryFilter.groupId=true

    This way maven will search all artifacts with group id org.thirdparty.lib in the thrirdpartyrepo repository and in maven central for the others.

    This will largely improve build/download time.

    But if you want to use that to have a full control of "what is downloaded where" this is not enough !

    Why ?

    1. If artefact are not found in thirparty repo it will fallback to other available repositories and if there is no Remote Reposite Filtering file for it then all is allowed.

    2. if some dependencies declare <repositories> in their pom.xml then those repositories will be automatically/discreetly added to possible repositories to search in. (and possibly you didn't add Remote Reposite Filtering file for it too..)

    There are solution for that :

    for 2) since maven 3.9.7, you can launch maven with -itr,--ignore-transitive-repositories and so If set, Maven will ignore remote repositories introduced by transitive dependencies OR you can use -Daether.remoteRepositoryFilter.groupId.noInputOutcome=false to blocks all requests toward a remote repository without groupId filtering file. (only available since maven 4.0.0-rc6)

    for 1) you can create rules for your maven central repo adding groupId-central.txt in .mvn/rrfwith :

    *
!org.thirdparty.lib

    This * wildcard is available since maven 4.0.0-rc6.

    Some more info about that :