Re: central-publishing-maven-plugin breaks with Maven 3.10.0-rc-1 under Windows

Hi Tamás,

Thanks a lot for digging into the plugin sources -- that settles the reported
problem, and I learned a few things along the way. Summary:

The root cause is not in Maven / Resolver. file-lock as the Resolver 2 default is
intentional, and it is the right choice: named locks protect the local repository
against concurrent (multi-process) access, and -- unlike an existence-based lock (a
lock dir/file) -- an OS advisory file lock is released automatically when the process
dies, so there are no stale locks after a crash. The lock file also has to live at
the repo root it protects, so any party using the local repo (another Maven, JBang,
...) can discover it deterministically. Moving it elsewhere would break both
discovery and, as Elliotte noted, the "keep everything in the project tree" security
posture.

The ".locks" showing up in the staging tree was the tell: the central-publishing
plugin uses the local repository itself to stage and zip artifacts (via
maven-compat's ArtifactInstaller / Maven-2 bits), which is also why it does not work
with Maven 4.

One nuance I verified: on Linux/macOS the lock files are never even visible --
DELETE_ON_CLOSE is implemented as unlink-while-open, so they are gone the moment they
are opened and survive even a hard kill. So this only surfaces on Windows at all,
where DELETE_ON_CLOSE is disabled (JDK-8252883). And even there a cleanup switch
already exists (-Daether.named.file-lock.deleteLockFiles=true); the only open question
is whether that retry-based path is robust enough under contention to become the
Windows default.

For anyone hitting the original problem: it is a plugin issue, not a Maven 3.10 /
Resolver regression -- stay on 3.9.x with that plugin, or move to Njord for
publishing.

I will close the resolver issue I filed (apache/maven-resolver#2017) as not-a-bug,
pointing back to this thread. Thanks again for the clear explanation!

Best regards,
Gerd


> On 29. Jul 2026, at 10:14, Tamás Cservenák <[email protected]> wrote:
> 
> Howdy,
> 
> just to fill in some factual information to this thread:
> 
> - Resolver 2 uses by default file-lock, while Resolver 1 does not.
> This is right (but file-lock exists there as well)
> - The reason for the existence of "named locks" (and file-lock and
> many other implementations) is to protect your local repository
> consistency in case of concurrent access.
> - hence, the fact that Maven is single process is irrelevant (or
> single threaded vs parallel), as if you have 2 or more single threaded
> Maven processes on same host, they will all go for your shared local
> repository (by default)
> - the presence of `.locks` in staging directory is telling: given this
> directory is created at local repository  root, it implies that the
> plugin uses local repository to stage artifacts (and seemingly zip
> them up too)
> - this is inherently wrong, we are long time past the times (it was
> like it in Maven 2) where repo is "just a bunch of files". For
> example, what happens with this plugin when you enable "split local
> repository"?
> 
> Hence, I went and downloaded sources for plugin in question (as they
> are deployed):
> https://repo.maven.apache.org/maven2/org/sonatype/central/central-publishing-maven-plugin/0.11.0/central-publishing-maven-plugin-0.11.0-sources.jar
> 
> And, look: here is the relevant snippet from it:
> https://gist.github.com/cstamas/a71f682030a2f1a1600ba4a4147c3bc7
> 
> And it reveals several issue:
> - "stager" does (mis)use local repo to stage
> - this component uses Maven 2 bits
> - ArtifactInstaller
> (https://github.com/apache/maven/blob/maven-3.9.x/maven-compat/src/main/java/org/apache/maven/artifact/installer/ArtifactInstaller.java)
> comes from `maven-compat` module, that is Maven 2 support, not even
> Maven 3.
> - hence, this plugin relies on Maven 2 features, and is also known to
> not work with Maven 4
> 
> So, while I am very involved with Njord, I cannot say anything else
> then: "please use Njord".
> 
> Thanks
> T
> 
> On Wed, 29 Jul 2026 at 06:31, Mark Derricutt <[email protected]> wrote:
>> 
>> Oh man - I was hitting this doing a release the other week, and totally
>> forgot I was using rc1!
>> 
>> *drops back to 3.9.16*
>> 
>> Marj
>> 
>> --
>> "Great artists are extremely selfish and arrogant things" — Steven Wilson,
>> Porcupine Tree
>> 
>> 
>>>>> - Bundle has content that does NOT have a .pom file:
>>> 
>>> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
> 

--
Gerd Aschemann (er/he) --- Veröffentlichen heißt Verändern (Carmen Thomas)
+49/173/3264070 -- [email protected] -- https://aschemann.net