I have a parent pom deployed to Artifactory (3.9.3), which when downloaded into local Maven repo by Maven itself (3.2.5, as a normal part of the Maven build lifecycle), is not the same as what is deployed. If I download the file directly with curl, I get
the expected file. I have confirmed that the file put in my local cache from a ‘mvn install’ or ‘mvn deploy’ is the unmodified file, and the file deployed in Artifactory is also correct. The .sha1 file in my local M2 cache has a different value than the SHA1
reported for this file in artifactory. It _mostly_ looks like innocuous XML cleanup (replacing <tag></tag> with <tag/> and removing newlines between attributes in elements leaving a very long line that had been formatted for readability. The part that
caused me to even look into this is I have a <repositories> element which is being completely removed from the copy that Maven downloads into the M2 cache, so my build fails because it can’t find any dependencies. However this does not happen if I put the <repositories>
in a profile. Attached is a stripped down version of the pom which exhibits the problem for me (internal hostnames in the url have been sanitized with art.example.com, releaseName property is set in the aggregator/parent POM of each source repository, and if
necessary the eclipse.release property is overridden in the same pom.xml as releaseName, the p2.type is set on the command-line in CI so developers get the URL it).
I’ve already emailed jFrog to see if it’s on the Artifactory end but I get the right file when I download it with anything other than Maven. Wanted to cover my bases for fast resolution by checking here too.