remove-project-artifact doesn't remove metadata

[chrylis]

As a workaround for a rough spot in Artifactory, I'm using remove-project-artifact to clear artifacts from test builds on a Jenkins server. However, the metadata for the removed artifact isn't cleared, which means that the next time that Jenkins tries to build a project that depends on "this" one with a matching version range, the downstream build fails because Jenkins can't resolve the "missing" version. These projects are not resolved from any external repository when built on the CI server.

Reproduction:

• create project A with version 0.1.0, install
• update A to 0.1.1, install, run remove-project-artifact
• create project B that depends on A:[0.1.0,0.2.0)

Expected behavior: B resolves the latest existing version of A (0.1.0). Instead, it resolves the removed version 0.1.1, and the Maven build fails.

Example maven-metadata-local.xml "before":

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>io.ngin.sandbox.build</groupId>
  <artifactId>build-sandbox</artifactId>
  <versioning>
    <release>3.0.1</release>
    <versions>
      <version>3.0.0</version>
      <version>3.0.1</version>
    </versions>
    <lastUpdated>20180709210726</lastUpdated>
  </versioning>
</metadata>

Example after version 3.0.2 was installed and deleted (this will fail because 3.0.2 doesn't exist):

<?xml version="1.0" encoding="UTF-8"?>
<metadata>
  <groupId>io.ngin.sandbox.build</groupId>
  <artifactId>build-sandbox</artifactId>
  <versioning>
    <release>3.0.2</release>
    <versions>
      <version>3.0.0</version>
      <version>3.0.1</version>
      <version>3.0.2</version>
    </versions>
    <lastUpdated>20180711173248</lastUpdated>
  </versioning>
</metadata>

[lasselindqvist]

The right approach is probably as Maven core does it and read and write the changes the following way:

Reader reader = ReaderFactory.newXmlReader( metadataFile );
MetadataXpp3Reader mappingReader = new MetadataXpp3Reader();
Metadata metadata = mappingReader.read( reader, false );
metadata.getVersioning().removeVersion(project.getArtifact().getVersion());
Writer writer = WriterFactory.newXmlWriter( metadataFile );
MetadataXpp3Writer mappingWriter = new MetadataXpp3Writer();
mappingWriter.write( reader, false );

with proper catch clauses closing of the streams.

[slawekjaranowski]

Simply we should not edit maven-metadata-local.xml it is internal Maven feature and may be changed in some version