Maven lastUpdated timestamps in maven-metadata.xml have been set to the future

Issue

I am using Maven 3.9.1 on Windows 10. I also use Eclipse EE 2023-03, which contains m2e (Eclipse's support for Maven). I am checking a POM for plugin version updates using the Versions Maven Plugin, but many aren't showing up even though another person sees updates available in Maven Central when checking against the same POM. (See Issue #959.) After some investigation it appears that the <lastUpdated> values in maven-metadata.xml in my local repository have been set to the future. I can try to override them, but first I am trying to find out how it happened so that I can prevent it from happening again.

I ran the following update to get Maven debug information:

mvn -X versions:display-plugin-updates

Here is part of my result:

…
[DEBUG] Checking com.akathist.maven.plugins.launch4j:launch4j-maven-plugin for updates newer than 2.1.3
[DEBUG] Could not find metadata com.akathist.maven.plugins.launch4j:launch4j-maven-plugin/maven-metadata.xml in local (C:\Users\user\.m2\repository)
[DEBUG] Skipped remote request for com.akathist.maven.plugins.launch4j:launch4j-maven-plugin/maven-metadata.xml, locally cached metadata up-to-date
[DEBUG] [com.akathist.maven.plugins.launch4j:launch4j-maven-plugin].version=2.1.3
[DEBUG] [com.akathist.maven.plugins.launch4j:launch4j-maven-plugin].artifactVersion=2.1.2
[DEBUG] [com.akathist.maven.plugins.launch4j:launch4j-maven-plugin].effectiveVersion=2.1.3
[DEBUG] [com.akathist.maven.plugins.launch4j:launch4j-maven-plugin].specified=true
…

However another person ran this output, and it indicated the following update (among others which also don't show up for me):

com.akathist.maven.plugins.launch4j:launch4j-maven-plugin 2.1.3 -> 2.4.1

It looks like on my machine Maven isn't seeing that com.akathist.maven.plugins.launch4j:launch4j-maven-plugin:2.1.3 needed updating. This debug information seems to be saying that it can't find C:\Users\user\.m2\repository\com\akathist\maven\plugins\launch4j\launch4j-maven-plugin\maven-metadata.xml. And in fact that file does not exist! Instead I have C:\Users\user\.m2\repository\com\akathist\maven\plugins\launch4j\launch4j-maven-plugin\maven-metadata-central.xml. (It's not clear to me what the difference is, and I can't find information about this online.)

But the more ominous line is this one:

[DEBUG] Skipped remote request for com.akathist.maven.plugins.launch4j:launch4j-maven-plugin/maven-metadata.xml, locally cached metadata up-to-date

The maven-metadata-central.xml file contains <lastUpdated>20210818055556</lastUpdated>, and an online Linux epoch timestamp converter tells me that this date is Saturday, June 16, 2610 12:07:35.556 PM!

Here is more information on files inside C:\Users\user\.m2\repository\com\akathist\maven\plugins\launch4j\launch4j-maven-plugin\:

• The checksum in maven-metadata-central.xml.sha1 matches the SHA-1 hash of maven-metadata-central.xml. But the file timestamp on maven-metadata-central.xml is almost a month later (2022-10-02) than that of maven-metadata-central.xml.sha1 (2022-09-08).
• The <lastUpdated>20210818055556</lastUpdated> inside maven-metadata-central.xml, as mentioned above, indicates 2610-06-16.
• The resolver-status.properties file timestamp is identical to that of maven-metadata-central.xml.sha1, so they were apparently modified at the same time. The comments inside resolver-status.properties also say it was modified on 2022-09-08, and the central.maven-metadata-central.xml.lastUpdated=1662676475074 inside the file also seems to say that Maven Central was checked on that date.

Interestingly 2022-09-08 is when I released v0.8.10 of this POM to Maven Central. As part of doing that, I used versions:use-releases, versions:set, and versions:display-dependency-updates; along with the Nexus Staging Maven Plugin of course. Since the checksum of maven-metadata-central.xml matches that in maven-metadata-central.xml.sha1, which was updated on 2022-09-08, it seems likely that the incorrect <lastUpdated>20210818055556</lastUpdated> was set on 2022-09-08.

Has anyone heard of what plugin or version of Maven or Eclipse m2e version or any bug or circumstances that might have resulted in setting <lastUpdated> to a date in the future for metadata in the C:\Users\user\.m2\repository\ tree?

Solution

Your question is based on the false assumption that in maven-metadata.xml the <lastUpdated> values are Linux epoch timestamps.

In fact, the <lastUpdated> values are given as yyyyMMddHHmmss timestamps.

For example, you can see this in the maven-metadata.xml file of the Versions Maven Plugin currently contains <lastUpdated>20230221231058</lastUpdated> as its latest version 2.15.0 has been released in February 2023.

Answered By - howlger