SNAPSHOT versions in dependency tree

[avodonosov]

The current representation of the dependency tree we hash seems not to reflect the version to which SNAPSHOT dependencies are resolved, printing them just as something like artifact-M.N-SNAPSHOT.

If so, hashversion does not change when new shapshot is downloaded, which is bad.

Investigate (also check for version ranges, for LATEST versions)

[avodonosov]

I hoped to hash the timestamp-based version assigned to snapshots when they are uploaded to snapshot repository. But this version is not available in the DependencyTreeNode objects (more precisely, it's only available first time, if snapshot dependency is resolved during dependency tree calculation, on the next run when the snapshot is already in ~/.m2 the timestamp based version is unavailable). Also, if the snapshot was installed to ~/m2 directly, without remote repo, the timestamp based version does not exists (or does it? does mvn install generate that timestamp version?)

[avodonosov]

The options we have

• Fail if snapshot is present in dependency tree
• Ignore the problem - just hash the shaphsot version name. This may result in some project modules build with old version of snapshot and other modules build with a newever version of the snapshot, so the modules won't be able to work together; Also, we don't rebuild when shapshot is updated.
• Resolve the snapshot artifact and hash the aftifact file (.jar or whatever). The most correct, although will slowdown the performance.
• Investigate possibility to do an analogue of versions:lock-snapshots (https://www.mojohaus.org/versions-maven-plugin/examples/lock-snapshots.html). Investigate is this timestamp based version available when snapshot was installed by mvn install to the local ~/.m2 rather then released and downloaded form a network repository.

[avodonosov]

I've tested version ranges like [1.1), LATEST, release qualified versions like 1-RELEASE - they are all resolved to and included into dependency tree as concrete versions, like 1.1.7.7.

So only SNAPSHOT versions are problematic.

For now implemented failing of the hashvers computation if SNAPHSOT version is detected in the dependency tree, with an option to ignore.

Probably that's enough - people who want immutable versioning will not use SNAPSHOTs I think.

In the future we can implement the "resolve artefact and hash the artifact file", or "lock snapshots" approach as described in the previous comment. Patches are welcome. (See canResolveArtifact method in https://github.com/avodonosov/hashver-maven-plugin/blob/master/src/main/java/pro/avodonosov/mvnhashver/MavenLifecycleParticipant.java for example how to resolve artifacts)