[MNG-8347] IT for transitive dependency management (#395)

Add IT for transitive dep management. The fix should come with updated Resolver 2.0.3

---

https://issues.apache.org/jira/browse/MNG-8347

.gitignore

@@ -16,3 +16,4 @@ jvz-*
 dependency-reduced-pom.xml
 .factorypath
 .java-version
+build-cache/

core-it-suite/src/test/java/org/apache/maven/it/MavenITmng8341DeadlockTest.java

@@ -23,6 +23,7 @@
 import org.apache.maven.shared.verifier.Verifier;
 import org.apache.maven.shared.verifier.util.ResourceExtractor;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
 
 /**
  * This is a test set for <a href="https://issues.apache.org/jira/browse/MNG-8341">MNG-8341</a>.
@@ -36,6 +37,7 @@ class MavenITmng8341DeadlockTest extends AbstractMavenIntegrationTestCase {
     /**
      *  Verify that the build succeeds
      */
+    @Timeout(value = 60)
     @Test
     void testDeadlock() throws Exception {
         File testDir = ResourceExtractor.simpleExtractResources(getClass(), "/mng-8341-deadlock");

core-it-suite/src/test/java/org/apache/maven/it/MavenITmng8347TransitiveDependencyManagerTest.java

@@ -0,0 +1,95 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.it;
+
+import java.io.File;
+import java.util.List;
+
+import org.apache.maven.shared.verifier.Verifier;
+import org.apache.maven.shared.verifier.util.ResourceExtractor;
+import org.junit.jupiter.api.Test;
+
+/**
+ * This is a test set for <a href="https://issues.apache.org/jira/browse/MRESOLVER-614">MRESOLVER-614</a> that is
+ * fixed in Resolver release 2.0.3.
+ * <p>
+ * Maven 3 was not transitive regarding dependency management. Maven4 started to be, but beta-5 discovered a nasty
+ * bug where Resolver was applying dependency management onto node itself it contributed (basically overriding
+ * same node direct dependencies).
+ */
+class MavenITmng8347TransitiveDependencyManagerTest extends AbstractMavenIntegrationTestCase {
+
+    MavenITmng8347TransitiveDependencyManagerTest() {
+        super("[3.9.0,)"); // since we have chained local repository
+    }
+
+    /**
+     * We run same command with various Maven versions and based on their version assert (Maven3 was not transitive,
+     * Maven4 before beta-6 was broken, post Maven 4 beta-6 all should be OK).
+     */
+    @Test
+    void transitiveDependencyManager() throws Exception {
+        File testDir = ResourceExtractor.simpleExtractResources(getClass(), "/mng-8347-transitive-dependency-manager");
+
+        Verifier verifier = new Verifier(testDir.getAbsolutePath());
+        verifier.addCliArgument("-V");
+        verifier.addCliArgument("dependency:3.8.0:tree");
+        verifier.addCliArgument("-Dmaven.repo.local.tail=" + testDir + "/local-repo");
+        verifier.addCliArgument("-Dmaven.repo.local.tail.ignoreAvailability");
+        verifier.execute();
+        verifier.verifyErrorFreeLog();
+
+        List<String> l = verifier.loadLines(verifier.getLogFileName(), "UTF-8");
+        if (matchesVersionRange("[3.9.0,4.0.0-alpha-12)")) {
+            // Maven3 is not transitive
+            a(l, "[INFO] org.apache.maven.it.mresolver614:root:jar:1.0.0");
+            a(l, "[INFO] \\- org.apache.maven.it.mresolver614:level1:jar:1.0.0:compile");
+            a(l, "[INFO]    \\- org.apache.maven.it.mresolver614:level2:jar:1.0.0:compile");
+            a(l, "[INFO]       \\- org.apache.maven.it.mresolver614:level3:jar:1.0.0:compile");
+            a(l, "[INFO]          \\- org.apache.maven.it.mresolver614:level4:jar:1.0.0:compile");
+            a(l, "[INFO]             \\- org.apache.maven.it.mresolver614:level5:jar:1.0.0:compile");
+            a(l, "[INFO]                \\- org.apache.maven.it.mresolver614:level6:jar:1.0.2:compile");
+        } else if (matchesVersionRange("[4.0.0-alpha-12,4.0.0-beta-5]")) {
+            // Maven 4 is transitive (added in 4.0.0-alpha-12, but was broken up to beta-6)
+            a(l, "[INFO] org.apache.maven.it.mresolver614:root:jar:1.0.0");
+            a(l, "[INFO] \\- org.apache.maven.it.mresolver614:level1:jar:1.0.0:compile");
+            a(l, "[INFO]    \\- org.apache.maven.it.mresolver614:level2:jar:1.0.0:compile");
+            a(l, "[INFO]       \\- org.apache.maven.it.mresolver614:level3:jar:1.0.1:compile");
+            a(l, "[INFO]          \\- org.apache.maven.it.mresolver614:level4:jar:1.0.1:compile");
+            a(l, "[INFO]             \\- org.apache.maven.it.mresolver614:level5:jar:1.0.2:compile");
+            a(l, "[INFO]                \\- org.apache.maven.it.mresolver614:level6:jar:1.0.2:compile");
+        } else if (matchesVersionRange("[4.0.0-beta-6,)")) {
+            // Maven 4 is transitive and should produce expected results
+            a(l, "[INFO] org.apache.maven.it.mresolver614:root:jar:1.0.0");
+            a(l, "[INFO] \\- org.apache.maven.it.mresolver614:level1:jar:1.0.0:compile");
+            a(l, "[INFO]    \\- org.apache.maven.it.mresolver614:level2:jar:1.0.0:compile");
+            a(l, "[INFO]       \\- org.apache.maven.it.mresolver614:level3:jar:1.0.0:compile");
+            a(l, "[INFO]          \\- org.apache.maven.it.mresolver614:level4:jar:1.0.1:compile");
+            a(l, "[INFO]             \\- org.apache.maven.it.mresolver614:level5:jar:1.0.2:compile");
+            a(l, "[INFO]                \\- org.apache.maven.it.mresolver614:level6:jar:1.0.2:compile");
+        }
+    }
+
+    /**
+     * Assert true, log lines contains string...
+     */
+    protected void a(List<String> logLines, String string) {
+        assertTrue("missing " + string, logLines.contains(string));
+    }
+}

core-it-suite/src/test/java/org/apache/maven/it/TestSuiteOrdering.java

@@ -120,6 +120,7 @@ public TestSuiteOrdering() {
          * the tests are to finishing. Newer tests are also more likely to fail, so this is
          * a fail fast technique as well.
          */
+        suite.addTestSuite(MavenITmng8347TransitiveDependencyManagerTest.class);
         suite.addTestSuite(MavenITmng8341DeadlockTest.class);
         suite.addTestSuite(MavenITmng8331VersionedAndUnversionedDependenciesTest.class);
         suite.addTestSuite(MavenITmng8299CustomLifecycleTest.class);

core-it-suite/src/test/resources/mng-8347-transitive-dependency-manager/README.md

@@ -0,0 +1,130 @@
+# MRESOLVER-614
+
+Facts:
+* root POM defines depMgt for level6 1.0.2
+* level1 POM defines depMgt for level5=1.0.2 and level6=1.0.1
+* level2 POM defines depMgt for level3=1.0.1, level4=1.0.1 and level5=1.0.1
+* without transitive manager (Maven3) all we see is root POM depMgt is applied (level6 = 1.0.2)
+* with transitive manager (Maven4) we should see level3 unchanged 1.0.0 (as level2 should not apply own depMgt onto its own dependencies), level4 managed to 1.0.1, and level5 managed by root to 1.0.2 (and not 1.0.1)
+
+Command to run:
+
+```
+mvn eu.maveniverse.maven.plugins:toolbox:tree -Dmaven.repo.local.tail=local-repo -Dmaven.repo.local.tail.ignoreAvailability
+```
+
+Example output with 3.9.9: Maven 3 is not transitive regarding dependency management, and it shows 1.0.0 all way down
+except for level5 that has applies depMgt from root.
+```
+$ mvn -V eu.maveniverse.maven.plugins:toolbox:tree -Dmaven.repo.local.tail=local-repo -Dmaven.repo.local.tail.ignoreAvailability
+Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937)
+Maven home: /home/cstamas/.sdkman/candidates/maven/3.9.9
+Java version: 21.0.4, vendor: Eclipse Adoptium, runtime: /home/cstamas/.sdkman/candidates/java/21.0.4-tem
+Default locale: en_US, platform encoding: UTF-8
+OS name: "linux", version: "6.11.4-201.fc40.x86_64", arch: "amd64", family: "unix"
+[INFO] Scanning for projects...
+[INFO] 
+[INFO] ---------------< org.apache.maven.it.mresolver614:root >----------------
+[INFO] Building root 1.0.0
+[INFO]   from pom.xml
+[INFO] --------------------------------[ jar ]---------------------------------
+[INFO] 
+[INFO] --- toolbox:0.3.5:tree (default-cli) @ root ---
+[INFO] org.apache.maven.it.mresolver614:root:jar:1.0.0
+[INFO] ╰─org.apache.maven.it.mresolver614:level1:jar:1.0.0 [compile]
+[INFO]   ╰─org.apache.maven.it.mresolver614:level2:jar:1.0.0 [compile]
+[INFO]     ╰─org.apache.maven.it.mresolver614:level3:jar:1.0.0 [compile]
+[INFO]       ╰─org.apache.maven.it.mresolver614:level4:jar:1.0.0 [compile]
+[INFO]         ╰─org.apache.maven.it.mresolver614:level5:jar:1.0.0 [compile]
+[INFO]           ╰─org.apache.maven.it.mresolver614:level6:jar:1.0.2 [compile] (version managed from 1.0.0)
+[INFO] ------------------------------------------------------------------------
+[INFO] BUILD SUCCESS
+[INFO] ------------------------------------------------------------------------
+[INFO] Total time:  0.192 s
+[INFO] Finished at: 2024-10-24T19:20:39+02:00
+[INFO] ------------------------------------------------------------------------
+$ 
+```
+
+Example output with 4.0.0-beta-5: **this version is transitive but broken**, as it applies level2 depMgt onto its own
+dependencies.
+```
+$ mvn -V eu.maveniverse.maven.plugins:toolbox:tree -Dmaven.repo.local.tail=local-repo -Dmaven.repo.local.tail.ignoreAvailability
+Apache Maven 4.0.0-beta-5 (6e78fcf6f5e76422c0eb358cd11f0c231ecafbad)
+Maven home: /home/cstamas/.sdkman/candidates/maven/4.0.0-beta-5
+Java version: 21.0.4, vendor: Eclipse Adoptium, runtime: /home/cstamas/.sdkman/candidates/java/21.0.4-tem
+Default locale: en_US, platform encoding: UTF-8
+OS name: "linux", version: "6.11.4-201.fc40.x86_64", arch: "amd64", family: "unix"
+[WARNING] Unable to find the root directory. Create a .mvn directory in the root directory or add the root="true" attribute on the root project's model to identify it.
+[WARNING] Legacy/insecurely encrypted password detected for server my-legacy-server
+[WARNING] Legacy/insecurely encrypted password detected for server my-legacy-broken-server
+[INFO] Scanning for projects...
+[INFO] 
+[INFO] ----------------------------------------< org.apache.maven.it.mresolver614:root >-----------------------------------------
+[INFO] Building root 1.0.0
+[INFO]   from pom.xml
+[INFO] ---------------------------------------------------------[ jar ]----------------------------------------------------------
+[INFO] 
+[INFO] --- toolbox:0.3.5:tree (default-cli) @ root ---
+[INFO] org.apache.maven.it.mresolver614:root:jar:1.0.0
+[INFO] ╰─org.apache.maven.it.mresolver614:level1:jar:1.0.0 [compile]
+[INFO]   ╰─org.apache.maven.it.mresolver614:level2:jar:1.0.0 [compile]
+[INFO]     ╰─org.apache.maven.it.mresolver614:level3:jar:1.0.1 [compile] (version managed from 1.0.0)
+[INFO]       ╰─org.apache.maven.it.mresolver614:level4:jar:1.0.1 [compile] (version managed from 1.0.0)
+[INFO]         ╰─org.apache.maven.it.mresolver614:level5:jar:1.0.2 [compile] (version managed from 1.0.0)
+[INFO]           ╰─org.apache.maven.it.mresolver614:level6:jar:1.0.2 [compile] (version managed from 1.0.0)
+[INFO] --------------------------------------------------------------------------------------------------------------------------
+[INFO] BUILD SUCCESS
+[INFO] --------------------------------------------------------------------------------------------------------------------------
+[INFO] Total time:  0.285 s
+[INFO] Finished at: 2024-10-24T19:21:10+02:00
+[INFO] --------------------------------------------------------------------------------------------------------------------------
+$ 
+```
+
+The **expected** output is:
+```
+[INFO] --- toolbox:0.3.5:tree (default-cli) @ root ---
+[INFO] org.apache.maven.it.mresolver614:root:jar:1.0.0
+[INFO] ╰─org.apache.maven.it.mresolver614:level1:jar:1.0.0 [compile]
+[INFO]   ╰─org.apache.maven.it.mresolver614:level2:jar:1.0.0 [compile]
+[INFO]     ╰─org.apache.maven.it.mresolver614:level3:jar:1.0.0 [compile] == unmanaged, level2 depends on level3:1.0.0
+[INFO]       ╰─org.apache.maven.it.mresolver614:level4:jar:1.0.1 [compile] (version managed from 1.0.0) == by level2
+[INFO]         ╰─org.apache.maven.it.mresolver614:level5:jar:1.0.2 [compile] (version managed from 1.0.0) == by level1 to 1.0.2 and level2 to 1.0.1 but level1 wins (closer to root)
+[INFO]           ╰─org.apache.maven.it.mresolver614:level6:jar:1.0.2 [compile] (version managed from 1.0.0) == by root to 1.0.2 and level1 to 1.0.1 but root wins (closer to root)
+```
+
+Maven 4.0.0-SNAPSHOT + Resolver [2.0.3-SNAPSHOT](https://github.com/apache/maven-resolver/pull/588) output **is expected output**:
+```
+$ ~/Tools/maven/apache-maven-4.0.0-beta-6-SNAPSHOT/bin/mvn -V eu.maveniverse.maven.plugins:toolbox:tree -Dmaven.repo.local.tail=local-repo -Dmaven.repo.local.tail.ignoreAvailability
+Apache Maven 4.0.0-beta-6-SNAPSHOT (cf94fba0151ff403763bdf23eb73fe74b3d0874d)
+Maven home: /home/cstamas/Tools/maven/apache-maven-4.0.0-beta-6-SNAPSHOT
+Java version: 21.0.4, vendor: Eclipse Adoptium, runtime: /home/cstamas/.sdkman/candidates/java/21.0.4-tem
+Default locale: en_US, platform encoding: UTF-8
+OS name: "linux", version: "6.11.4-201.fc40.x86_64", arch: "amd64", family: "unix"
+[WARNING] Unable to find the root directory. Create a .mvn directory in the root directory or add the root="true" attribute on the root project's model to identify it.
+[WARNING] Legacy/insecurely encrypted password detected for server my-legacy-server
+[WARNING] Legacy/insecurely encrypted password detected for server my-legacy-broken-server
+[INFO] Scanning for projects...
+[INFO] 
+[INFO] ----------------------------------------< org.apache.maven.it.mresolver614:root >-----------------------------------------
+[INFO] Building root 1.0.0
+[INFO]   from pom.xml
+[INFO] ---------------------------------------------------------[ jar ]----------------------------------------------------------
+[INFO] 
+[INFO] --- toolbox:0.3.5:tree (default-cli) @ root ---
+[INFO] org.apache.maven.it.mresolver614:root:jar:1.0.0
+[INFO] ╰─org.apache.maven.it.mresolver614:level1:jar:1.0.0 [compile]
+[INFO]   ╰─org.apache.maven.it.mresolver614:level2:jar:1.0.0 [compile]
+[INFO]     ╰─org.apache.maven.it.mresolver614:level3:jar:1.0.0 [compile]
+[INFO]       ╰─org.apache.maven.it.mresolver614:level4:jar:1.0.1 [compile] (version managed from 1.0.0)
+[INFO]         ╰─org.apache.maven.it.mresolver614:level5:jar:1.0.2 [compile] (version managed from 1.0.0)
+[INFO]           ╰─org.apache.maven.it.mresolver614:level6:jar:1.0.2 [compile] (version managed from 1.0.0)
+[INFO] --------------------------------------------------------------------------------------------------------------------------
+[INFO] BUILD SUCCESS
+[INFO] --------------------------------------------------------------------------------------------------------------------------
+[INFO] Total time:  0.312 s
+[INFO] Finished at: 2024-10-24T21:11:21+02:00
+[INFO] --------------------------------------------------------------------------------------------------------------------------
+$ 
+```

core-it-suite/src/test/resources/mng-8347-transitive-dependency-manager/local-repo/org/apache/maven/it/mresolver614/level1/1.0.0/level1-1.0.0.pom

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.apache.maven.it.mresolver614</groupId>
+    <artifactId>level1</artifactId>
+    <version>1.0.0</version>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.apache.maven.it.mresolver614</groupId>
+                <artifactId>level5</artifactId>
+                <version>1.0.2</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.maven.it.mresolver614</groupId>
+                <artifactId>level6</artifactId>
+                <version>1.0.1</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.maven.it.mresolver614</groupId>
+            <artifactId>level2</artifactId>
+            <version>1.0.0</version>
+        </dependency>
+    </dependencies>
+</project>

core-it-suite/src/test/resources/mng-8347-transitive-dependency-manager/local-repo/org/apache/maven/it/mresolver614/level2/1.0.0/level2-1.0.0.pom

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.apache.maven.it.mresolver614</groupId>
+    <artifactId>level2</artifactId>
+    <version>1.0.0</version>
+
+    <dependencyManagement>
+        <dependencies>
+            <!-- should not override own dependency spec -->
+            <dependency>
+                <groupId>org.apache.maven.it.mresolver614</groupId>
+                <artifactId>level3</artifactId>
+                <version>1.0.1</version>
+            </dependency>
+            <!-- manages child dependency -->
+            <dependency>
+                <groupId>org.apache.maven.it.mresolver614</groupId>
+                <artifactId>level4</artifactId>
+                <version>1.0.1</version>
+            </dependency>
+            <!-- should lose to level1 depMgt which is closer to root -->
+            <dependency>
+                <groupId>org.apache.maven.it.mresolver614</groupId>
+                <artifactId>level5</artifactId>
+                <version>1.0.1</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.maven.it.mresolver614</groupId>
+            <artifactId>level3</artifactId>
+            <version>1.0.0</version>
+        </dependency>
+    </dependencies>
+</project>

core-it-suite/src/test/resources/mng-8347-transitive-dependency-manager/local-repo/org/apache/maven/it/mresolver614/level3/1.0.0/level3-1.0.0.pom

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.apache.maven.it.mresolver614</groupId>
+    <artifactId>level3</artifactId>
+    <version>1.0.0</version>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.maven.it.mresolver614</groupId>
+            <artifactId>level4</artifactId>
+            <version>1.0.0</version>
+        </dependency>
+    </dependencies>
+</project>

core-it-suite/src/test/resources/mng-8347-transitive-dependency-manager/local-repo/org/apache/maven/it/mresolver614/level3/1.0.1/level3-1.0.1.pom

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.apache.maven.it.mresolver614</groupId>
+    <artifactId>level3</artifactId>
+    <version>1.0.1</version>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.maven.it.mresolver614</groupId>
+            <artifactId>level4</artifactId>
+            <version>1.0.0</version>
+        </dependency>
+    </dependencies>
+</project>

core-it-suite/src/test/resources/mng-8347-transitive-dependency-manager/local-repo/org/apache/maven/it/mresolver614/level4/1.0.0/level4-1.0.0.pom

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.apache.maven.it.mresolver614</groupId>
+    <artifactId>level4</artifactId>
+    <version>1.0.0</version>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.maven.it.mresolver614</groupId>
+            <artifactId>level5</artifactId>
+            <version>1.0.0</version>
+        </dependency>
+    </dependencies>
+</project>