How to make sure a tycho build doesn't include snapshot dependencies

Question

During a non-tycho release, Maven checks if there are snapshot dependencies in the project being built.

Is there a way to do the same thing with an E4 project, built with Tycho?

Answer 1

p2 repositories don't have a (formal) notion of snapshot and non-snapshot artifacts. So technically you never have snapshot dependencies in a Tycho build, as long as you don't use SNAPSHOT artifacts from Maven repositories via pomDependencies=consider. The latter can be prevented in the same way as in Maven, i.e. by controlling the Maven repositories in your settings.xml (see e.g. this other answer).

But probably this isn't what you are looking for. You probably want to make sure that you don't reference artifacts which will disappear eventually and make your build non-reproducible. For this, you have to check the retention policy of the referenced p2 repositories and make sure that you only reference p2 repositories which are retained "forever". (Example: Retention policy of the Eclipse project p2 repositories.)

If the retention policies are not good enough (or you don't trust the providers to actually stick to them), you need to store copies of the referenced p2 repositories. You can for example download the p2 repositories as zip (or mirror the repository and zip it yourself), deploy it to a Nexus OSS and access it from your build via the Unzip Plugin. (Disclaimer: The Unzip Plugin is an offering of the Tycho project, of which I am a committer.)

Answer 2

Have a look at the Maven Settings References:

Repositories: releases, snapshots: These are the policies for each type of artifact, Release or snapshot. With these two sets, a POM has the power to alter the policies for each type independent of the other within a single repository. For example, one may decide to enable only snapshot downloads, possibly for development purposes. enabled: true or false for whether this repository is enabled for the respective type (releases or snapshots). updatePolicy: This element specifies how often updates should attempt to occur. Maven will compare the local POM's timestamp (stored in a repository's maven-metadata file) to the remote. The choices are: always, daily (default), interval:X (where X is an integer in minutes) or never. checksumPolicy: When Maven deploys files to the repository, it also deploys corresponding checksum files. Your options are to ignore, fail, or warn on missing or incorrect checksums. layout: In the above description of repositories, it was mentioned that they all follow a common layout. This is mostly correct. Maven 2 has a default layout for its repositories; however, Maven 1.x had a different layout. Use this element to specify which if it is default or legacy.

I think the setting you're after could approximate the following.

<repository>
    <id>my-repo</id>
    <name>My Repo</name>
    <url>http://my.repo.org</url>
    <snapshots>
        <enabled>false</enabled>
        <updatePolicy>never</updatePolicy>
    </snapshots>
</repository>