With verifyPlugins=true plugins are resolved from ProjectRepositories instead of PluginRepositories (original) (raw)

Describe the bug
With verifyPlugins/verifyPluginDependencies set to true plugins (and plugin dependencies) are being resolved with

session.getCurrentProject().getRemoteProjectRepositories() // ProjectRepositories

This makes the pgpverify-maven-plugin to fail if verified plugin (or its dependencies) is not available in non-plugin repository.

To Reproduce
This change of removing plugin repository from non-plugin repositories (added as workaround in master there) shows that it is ok for build without pgpverify:check, and is problematic for pgpverify plugin to carry on.

Expected behavior
Plugins and plugin dependencies are being resolved with

session.getCurrentProject().getRemotePluginRepositories() // PluginRepositories

Additional context