When some (specific) transitive dependencies are excluded in the POM file but the assembly descriptor is set to fetch all dependencies, the excluded dependencies will be included in assembly. How can I prevent this?
Some dependencies may be tricky to handle because their groupIds and artifactIds change at almost each version (in my case, bouncycastle).
I am retrieving several versions of bouncycastle (138, 1.38, 1.45 and 1.50). My purpose is to eliminate all versions other than 1.50. To be precise, I have one dependency (let's call it some.perfectly.done:job) which imports 1.50 and one other (how.many.castles:do-you-need) which imports all others. They are corporate dependencies, so giving you real groupId:artifactId wouldn't help you for testing.
My dependencies are declared as follows:
<dependency>
<groupId>some.perfectly.done</groupId>
<artifactId>job</artifactId>
</dependency>
<dependency>
<groupId>how.many.castles</groupId>
<artifactId>do-you-need</artifactId>
<exclusions>
<exclusion>
<groupId>org.bouncycastle</groupId>
<artifactId>*</artifactId>
</exclusion>
<exclusion>
<groupId>bouncycastle</groupId>
<artifactId>*</artifactId>
</exclusion>
</exclusions>
</dependency>
<assembly xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3 http://maven.apache.org/xsd/assembly-1.1.3.xsd">
<id>bin</id>
<formats>
<format>zip</format>
</formats>
<!-- Adds dependencies to zip package under lib directory -->
<dependencySets>
<dependencySet>
<useProjectArtifact>false</useProjectArtifact>
<useTransitiveFiltering>true</useTransitiveFiltering>
<outputDirectory>lib</outputDirectory>
<outputFileNameMapping>${artifact.groupId}.${artifact.artifactId}-${artifact.version}${dashClassifier?}.${artifact.extension}</outputFileNameMapping>
<unpack>false</unpack>
</dependencySet>
</dependencySets>
<!-- ... -->
</assembly>
$ ls *bouncycastle*
bouncycastle.bcmail-jdk14-138.jar org.bouncycastle.bcmail-jdk15on-1.50.jar org.bouncycastle.bcprov-jdk15-1.45.jar
bouncycastle.bcprov-jdk14-138.jar org.bouncycastle.bcpkix-jdk15on-1.50.jar org.bouncycastle.bcprov-jdk15on-1.50.jar
org.bouncycastle.bcmail-jdk14-1.38.jar org.bouncycastle.bcprov-jdk14-1.38.jar org.bouncycastle.bctsp-jdk14-1.38.jar
$ ls *bouncycastle*
org.bouncycastle.bcmail-jdk15on-1.50.jar org.bouncycastle.bcpkix-jdk15on-1.50.jar org.bouncycastle.bcprov-jdk15on-1.50.jar
The real value in an answer here would be to find a real, generic solution. I am not looking to solve my case, I'd like to find a solution for all people with a similar case.
As such, I'd like to avoid some solutions which would work but are really related to a particular case and often requires to duplicate the POM's logic into the assembly descriptor.
These are however leads that may help if nothing better can be found.
Obviously. In my own case though, quite impractical, except by the intelligent use of includes/excludes. This is not a practical solution.
Note that I am aware this question has already been asked, but the only attempt at an answer is unsatisfactory for my case:
If you have such thing you need to define two dependencySet entries one which include the logback [with
useTransitiveDependencies=false] and other.
(by khmarbaise)
maven-dependency-pluginOn the same question as above, an approach which I might use if no question is asked has been proposed: first use dependency:copy-dependencies to copy my correct dependencies to a temporary directory, then assemble my zip from this directory.
As a workaround, this is probably the most valid solution, as being generic and not duplicating the logic from the POM in the assembly descriptor, though this makes the build longer.
Why does the maven-assembly-plugin behave this way? I did not find any reference to this in the documentation. Is it desired behavior, or is it a (known/unknown) bug?
Version 3.1.1 of the maven-assembly-plugin have been released Jan 01, 2019. It solves the JIRA issues mentioned in my answer below (kept for history or for users that cannot upgrade the plugin). With this version, maven-assembly-plugin now honors wildcards in dependencies exclusions. Simply upgrade the plugin.
maven-assembly-plugin version <= 3.1.0It appears that Maven assembly plugin (version <= 3.1.0) does not honor exclusions using wildcards (*), see MASSEMBLY-762, MASSEMBLY-861 or MASSEMBLY-675. From the last JIRA issue, the problem will be solved in version 3.1.1 of the plugin (see commit). At the moment of writing, the .3.1.1 version is not released : 3.1.0 is the latest version
Hopefully, the problem can be solved with version <= 3.1.0.
To do so, just declare the right excluded artifacts instead of *, and it works properly. It can be painful to list all excluded dependencies, but at least I think it is a better solution than the accepted one (less tweaking of Maven phases), especially on multi-modules project with cross dependencies (my case). Moreover, by doing so, you have more control about the dependencies.
Hope that helps, waiting the 3.1.1 version! :)