Why is incorrect URL used for glassfish's security-all jar from Maven repo? - glassfish

Question

I added the following to build.sbt (doing programmatic login with embedded GlassFish for unit tests):
libraryDependencies += "org.glassfish.main.security" % "security-all" % "4.0"
However sbt seems to try to fetch the wrong URL. It tries to get (note the additional glassfish- in the extension):
http://repo1.maven.org/maven2/org/glassfish/main/security/security-ee/4.0/security-ee-4.0.glassfish-jar
But the actual jar file is at:
http://repo1.maven.org/maven2/org/glassfish/main/security/security-ee/4.0/security-ee-4.0.jar
So instead of using .jar as the extension it appears to be using .glassfish-jar for some reason and am facing the following download failed errors:
[trace] Stack trace suppressed: run last *:update for the full output.
[error] (*:update) sbt.ResolveException: download failed: org.glassfish.main.security#security;4.0!security.glassfish-jar
[error] download failed: org.glassfish.main.admin#config-api;4.0!config-api.glassfish-jar
[error] download failed: org.glassfish.main.common#common-util;4.0!common-util.glassfish-jar
[error] download failed: org.glassfish.main.common#glassfish-api;4.0!glassfish-api.glassfish-jar
[error] download failed: org.glassfish.main.common#scattered-archive-api;4.0!scattered-archive-api.glassfish-jar
[error] download failed: org.glassfish.main.security#ssl-impl;4.0!ssl-impl.glassfish-jar
[error] download failed: org.glassfish.main.common#internal-api;4.0!internal-api.glassfish-jar
[error] download failed: org.glassfish.main.deployment#deployment-common;4.0!deployment-common.glassfish-jar
[error] download failed: org.glassfish.main.security#security-ee;4.0!security-ee.glassfish-jar
[error] download failed: org.glassfish.main.common#glassfish-ee-api;4.0!glassfish-ee-api.glassfish-jar
[error] download failed: org.glassfish.main.deployment#dol;4.0!dol.glassfish-jar
[error] download failed: org.glassfish.main.common#annotation-framework;4.0!annotation-framework.glassfish-jar
[error] download failed: org.glassfish.main.security#jaspic.provider.framework;4.0!jaspic.provider.framework.glassfish-jar
[error] download failed: org.glassfish.main.ejb#ejb-internal-api;4.0!ejb-internal-api.glassfish-jar
[error] download failed: org.glassfish.main.connectors#connectors-internal-api;4.0!connectors-internal-api.glassfish-jar
[error] download failed: org.glassfish.main.transaction#transaction-internal-api;4.0!transaction-internal-api.glassfish-jar
[error] download failed: org.glassfish.main.admin#admin-util;4.0!admin-util.glassfish-jar
[error] download failed: org.glassfish.main.security#security-services;4.0!security-services.glassfish-jar
[error] download failed: org.glassfish.main.resources#resources-connector;4.0!resources-connector.glassfish-jar
[error] download failed: org.glassfish.main.resourcebase.resources#nucleus-resources;4.0!nucleus-resources.glassfish-jar
[error] download failed: org.glassfish.main.security#inmemory.jacc.provider;4.0!inmemory.jacc.provider.glassfish-jar
I have no idea why or even where to look. I would think it would be something with the pom file, but Netbeans (probably the Maven embedded in Netbeans) did not have any trouble with the same pom.
Also, all the "transitive" jars end up have the wrong URL as well, so they all fail.
I worked around it with this:
libraryDependencies += "org.glassfish.main.security" % "security-ee" % "4.0" from "http://repo1.maven.org/maven2/org/glassfish/main/security/security-ee/4.0/security-ee-4.0.jar" intransitive()
but I would rather not have to do that hoping there is a way to do this properly. My searches for a real solution to this came up empty. Please advise.

Answer 1

The reason for the behaviour is that the module defines the packaging glassfish-jar for some of the transitive dependencies - see inmemory.jacc.provider-4.0.pom and security-4.0.pom:
<packaging>glassfish-jar</packaging>
Run sbt update in the project and open target/resolution-cache/reports/default-glassfish-security_2.10-compile.xml for the resolution report for the Compile (default) configuration.
Use sbt-dependency-graph to visualize your project's dependencies.