[MNG-8523] User properties should override model properties in the model

[jira-importer]

Tamas Cservenak opened MNG-8523 and commented

The installed/deployed POMs using these are not inlined, and that means those are unusable. Same situation as with Maven 3, that forces use of flatten plugin to make them usable.

---

Issue Links:

• MNG-7635 Investigate how to safely propagate user properties to dependencies (see MNG-5982 and MNG-7417)

• MNG-8527 Re-enable consumer POM

Remote Links:

• GitHub Pull Request #2059
  

[jira-importer]

Michael Osipov commented

I bet I have this issue already long time ago.

[jira-importer]

Guillaume Nodet commented

This is fixed when using the consumer POM though.

This is also not specific to CI friendly versions, but any property. When using a property in a version, we do check that the property exists. However, we don't check where it comes from. It may come from a model property or from a user property. When a property is defined in the model, and this POM is used as a dependency, the user properties from outside won't be used, because model properties from the dependency take precedence over user properties (unlike when building the POM). But this also means that when the original property is defined using a user property, there's no model property to override it, which means that the dependency version may be changed using a user property from CLI.
This looks really wrong.

This is definitely not new, and I'm not sure we can easily fix that in 3.x, but we may be able to do so with 4.x in the consumer POM.

[jira-importer]

Guillaume Nodet commented

Example of leaking:

➜  tmp mvn eu.maveniverse.maven.plugins:toolbox:gav-tree -Dgav=org.openjfx:javafx-controls:22.0.1  -Dos.name=windows -Dos.arch=amd64 -V -Djavafx.monocle=true
Apache Maven 4.0.0-rc-2 (273314404f85ec3c089e295d8b4e0cb18c287cf5)
Maven home: /Users/gnodet/work/apps/apache-maven-4.0.0-rc-2
Java version: 21.0.4, vendor: Eclipse Adoptium, runtime: /Users/gnodet/.sdkman/candidates/java/21.0.4-tem
Default locale: en_FR, platform encoding: UTF-8
OS name: "mac os x", version: "15.2", arch: "aarch64", family: "mac"
[INFO]
[INFO] Some problems were encountered while building the effective settings (use -X to see details)
[INFO]
[INFO] Mimir 0.2.3 session created
[INFO] Scanning for projects...
[INFO]
[INFO] -------------------------------------------< org.apache.maven:standalone-pom >--------------------------------------------
[INFO] Building Maven Stub Project (No POM) 1
[INFO] ---------------------------------------------------------[ pom ]----------------------------------------------------------
[INFO]
[INFO] --- toolbox:0.6.1:gav-tree (default-cli) @ standalone-pom ---
[WARNING] 6 problems were encountered while building the effective model for org.openjfx:javafx-controls:jar:22.0.1 during n/a (use -X to see details)
[INFO] org.openjfx:javafx-controls:jar:22.0.1
[INFO] ├─org.openjfx:javafx-controls:jar:win-monocle:22.0.1 [compile]
[INFO] ╰─org.openjfx:javafx-graphics:jar:22.0.1 [compile]
[INFO]   ├─org.openjfx:javafx-graphics:jar:win-monocle:22.0.1 [compile]
[INFO]   ╰─org.openjfx:javafx-base:jar:22.0.1 [compile]
[INFO]     ╰─org.openjfx:javafx-base:jar:win-monocle:22.0.1 [compile]
[INFO] --------------------------------------------------------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] --------------------------------------------------------------------------------------------------------------------------
[INFO] Total time:  0.270 s
[INFO] Finished at: 2025-01-17T17:27:04+01:00
[INFO] --------------------------------------------------------------------------------------------------------------------------

In this case, the javafx.monocle=true user property leaks to the dependency and causes the org.openjfx:javafx-controls:jar:win-monocle:22.0.1 artifact to be included.

The os.name and os.arch user properties also leak to activate a specific profile. I'm not sure this is a bad thing in this case, but this may need to be controlled more tightly.

[jira-importer]

Guillaume Nodet commented

Another problem is that if the property is defined as a model property and the user override it at build time using a user property from CLI, the installed pom will still contain the original model property.