GroupId filtering doesn't allow group children as documented

[sbernard31]

Affected version

1.9.24, 2.0.9

Bug description

Reading the documentation :

modifier (must be first, or second if negation modifier present) = is limiter (equals; by default entry is “and below this G”)

And

Line 3 means “allow org.apache.maven G and below”. Line 4 is “disallow org.apache.maven.foo” only" (so org.apache.maven.foo.bar is allowed due first line). Line 5 means “disallow org.apache.maven.indexer and below” and finally line 6 means “allow org.apache.bar ONLY” (so org.apache.bar.foo is NOT enabled).

So I expected that if I add org.apache in my groupId filtering file, then org.apache.maven will be accepted.
But when I test with maven3 3.9.11 (resolver 1.9.24) I get :

[ERROR] Plugin org.apache.maven.plugins:maven-compiler-plugin:3.13.0 or one of its dependencies could not be resolved:
[ERROR] 	The following artifacts could not be resolved: org.apache.maven:maven-parent:pom:41 (present, but unavailable): G:org.apache.maven NOT allowed from central (https://repo.maven.apache.org/maven2, default, releases)

And with maven4 4.0.0-rc-4 (resolver 2.0.9), I get pretty much the same:

[ERROR] Plugin org.apache.maven.plugins:maven-compiler-plugin:3.13.0 or one of its dependencies could not be resolved:
[ERROR] 	The following artifacts could not be resolved: org.apache.maven:maven-parent:pom:41 (present, but unavailable): G:org.apache.maven NOT allowed from central (https://repo.maven.apache.org/maven2, default, releases) (remote repositories: central (https://repo.maven.apache.org/maven2, default, releases), plexus.snapshots (https://oss.sonatype.org/content/repositories/plexus-snapshots, default, snapshots)): Failed to read artifact descriptor for org.apache.maven.plugins:maven-compiler-plugin:jar:3.13.0: One or more requests failed

Is it a bug OR did I miss something ? 🙏

[cstamas]

Howdy, for start, there are notable differences between RRF implementation in Resolver 1.x (originally implemented) and Resolver 2.x (improved). The respective documentation can be found here:
Resolver 1.x https://maven.apache.org/resolver-archives/resolver-1.9.24/remote-repository-filtering.html
Resolver 2.x https://maven.apache.org/resolver/remote-repository-filtering.html

(note: all sites archived are here https://maven.apache.org/resolver-archives/ also please note the version number on top right, it tells to which resolver documentation belongs to)

To achieve what Resolver 2.x is able regarding RRF with Resolver 1.x (Maven 3.9.x), one can use this extension:
https://github.com/maveniverse/heimdall

This was the "lab mouse" for Resolver 2.x improvements, and given is Maven 3 extension, brings Maven 3 "on par" with Maven 4 re RRF.

Without any extension, most notable RRF differences between Maven 3.9.x (Resolver 1.9.x) and Maven 4 (Resolver 2.0.x) are:

• mvn3 "supports" only org.apache like expressions (no ! and = modifiers) and means "this and only this". Hence, with vanilla RRF in Maven 3 one need to enumerate ALL groups.
• the improvements are ONLY in mvn 4-rc-5 and later, as mvn 4-rc-4 and prev use resolver release that lack this commit a78647b

[cstamas]

One note: I still need to do this: maveniverse/heimdall#20
To really make mvn3+heimdall and mvn4 "equally capable".

[cstamas]

And one final note: I understand this is still "just experimenting" with RRF, but in general, filtering Central is not something you want. The intent is better explained in demo: https://github.com/cstamas/rrf-demo

Basically, there are some "rogue" repositories out there that allows "shady" access to Central via alternative means (usually as they expose supergroups containing Central proxies as well instead of just hosted only).

Slightly related: https://maveniverse.eu/blog/2025/11/09/why-are-mrm-group-repositories-bad/

[sbernard31]

Thx a lot for your answers 🙏.

I understand that with version I tried this is normal that org.apache are consider as "this and only this".
All makes sense now

---

I tried with heimdall (0.1.3) but strangly If I had :

...
org.apache
org.apache.maven.plugin
...

Then I get this error :

[ERROR] Plugin org.apache.maven.plugins:maven-compiler-plugin:3.13.0 or one of its dependencies could not be resolved:
[ERROR] 	The following artifacts could not be resolved: org.apache.maven:maven-parent:pom:41 (present, but unavailable): G:org.apache.maven NOT allowed from central (https://repo.maven.apache.org/maven2, default, releases)

But if I only put :

...
org.apache
...

It works. Is it expected ?

---

When I have all my artefacts (dependencies and plugins) already downloaded locally.
If add a rule which doesn't allow to download an artefact at all (forbidden on all repo for testing purpose) then I face several behaviour.
(Not sure) but for plugins it seems that I get an error (like just above) (event if the artefact is already there)
and for code dependencies, if artefact is locally present : no error, no warning.

Is it expected ?

---

And one final note: I understand this is still "just experimenting" with RRF, but in general, filtering Central is not something you want. The intent is better explained in demo: https://github.com/cstamas/rrf-demo

Maybe I try to describe what I want to do and you tell me if I'm on the wrong direction.

So my goal is to have a full control of "where is download what" without usage of tools like nexus.
I want that everything is downloaded on maven central.
Except some third party (private) library under given groupId.

So my first idea was to just add groupId.thirdpartyrepo rules.
But I see that if there is no maven central rules then it is allowed to used it (even for that thirdparty lib)

So I try to add a rules file for central with something that allow everything except thirdpartylib.
But I see this is not doable for now.
(By the way will it be available in heimdall ?)

So I tried to create a kind of minimal maven central file with very few line putting only some well known groupid (org.apache, org.junit ... ) + the disallow rules for my thirdpartylib and that's how I came to ask you all of that question...
(I know I can record but I wanted to have a most simple as possible rules file)

Digging into that, I also discover that a dependency can discretely add a new repository and so maven will also search in that repository for artefacts and as default rules when no filtering file for a given repo is ALLOW every thing. I feel there is something wrong here. 🤔

Did I miss something ? or Do I try to to use Remote Repository Filtering for something it is not made for ?

[cstamas]

Yes, you may want to wait for 4-rc-6. Then, it will be hopefully doable.
For "dependency can discretely add a new repository" use mvn -itr, it will PREVENT this happening, but then the burden of defining all the required repositories is on you (ALL transitively introduced repositories gonna be ignored).

IIUC, those thirdparty libraries are also on central? Meaning, they have same coordinates?

[cstamas]

By the way, we published last night this:
https://dist.apache.org/repos/dist/dev/maven/maven-4/

Explanation on ML:
https://lists.apache.org/thread/yd4m17xz5xth7vhqobzop1rt4b0okztb

[sbernard31]

Thx again 🙏.

Do you think it could make sense to add a default value for all repositories ?
So we can say if there is no filtering file for a repository then consider all is ALLOWED or all is DISALLOWED.
Maybe something like a file named groupid.txt which contains inherited value.
Or a parameter like -Daether.remoteRepositoryFilter.groupId.default=value and value could be ALLOW/* OR DISALLOW / !*

Also I tested Maven 4.0.0-SNAPSHOT and * works as expected.
But kind of strange behavior (but maybe expected), I shared previously are still there : -Daether.remoteRepositoryFilter.groupId=true
If you consider this is potential real problem, I can create dedicated github issue.

[cstamas]

Which is exactly the "kind of strange behavior (but maybe expected), I shared previously are still there"?

[sbernard31]

First strange behavior :

If I had that rule for central :
...
org.apache
org.apache.maven.plugin
...

Then I get this error which means that org.apache.maven is not ALLOWED:

[ERROR] Plugin org.apache.maven.plugins:maven-compiler-plugin:3.13.0 or one of its dependencies could not be resolved:
[ERROR] The following artifacts could not be resolved: org.apache.maven:maven-parent:pom:41 (present, but unavailable): G:org.apache.maven NOT allowed from central (https://repo.maven.apache.org/maven2, default, releases)

But if I only put :
...
org.apache
...

org.apache.maven is ALLOWED. Is it expected ?

[sbernard31]

Second strange behaviour :

When I have all my artefacts (dependencies and plugins) already downloaded locally.
If add a rule which doesn't allow to download an artefact at all (disallowed in each repo for testing purpose) then I get different behaviour.

For plugins, even if artefact is locally present I get an error (like just above)
For code dependencies, if artefact is locally present : no error, no warning.

Is it expected ?

[cstamas]

Will look into these, thanks for testing and reporting!