[jira] [Commented] (DELTASPIKE-1088) Provide a BOM for deltaspike with no transitive dependencies

["Jörg Sesterhenn (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/DELTASPIKE-1088?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15311791#comment-15311791 ] 

Jörg Sesterhenn commented on DELTASPIKE-1088:
---------------------------------------------

Thanks for addressing this issue [~johndament]!

If you did this change in the master (https://github.com/apache/deltaspike/blob/master/deltaspike/dist/bom/pom.xml) then please do not consider this issue resolved.
The BOM is still no Bill of Materials as defined in https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Importing_Dependencies

Importing is only for managed-dependencies not for the dependencies itself (compare http://stackoverflow.com/questions/11778276/difference-between-scope-import-and-pom-type-dependency)

Please change the way the dist-parent-pom and bom work. A BOM should only contain dependency-management. Other Projects import BOMs and never inherit from or directly depend on boms to actually provide any dependencies. That way we and everybody else could import your BOM in a (company-)parent-pom and not have to worry about versions and scope of any deltaspike modules we use once we inherit from that (company-)parent-pom.

You should make the BOM do just the dependency-management. The parent pom should only import the BOM in its dependencymanagement and define the modules. The full module then would have to contain all the dependencies without any of the version and scope stuff.

If you have any questions regarding this please feel free to ask. 

> Provide a BOM for deltaspike with no transitive dependencies
> ------------------------------------------------------------
>
>                 Key: DELTASPIKE-1088
>                 URL: https://issues.apache.org/jira/browse/DELTASPIKE-1088
>             Project: DeltaSpike
>          Issue Type: Improvement
>          Components: Build
>    Affects Versions: 1.5.4
>            Reporter: Jörg Sesterhenn
>            Assignee: John D. Ament
>             Fix For: 1.6.2
>
>
> We have an enterprise parent POM that defines versions of maven artifacts for all products that are built in our enterprise.
> We want to define the version of all deltaspike artifacts in that parent pom. Idealy we would just import your BOM.
> Currently your BOM inherits a bloat of dependencies from the deltaspike parent POM. We don't want all of these transitive dependencymanagement entries in our parent POM. 
> So instead of importing your BOM we copy the entries for all deltaspike modules into our parent POM. This is a violation of DRY / cumbersome / error prone...
> Please provide a BOM that does not inherit any other dependencymanagement.
> One example of a great BOM is [the log4j BOM|http://central.maven.org/maven2/org/apache/logging/log4j/log4j-bom/2.5/log4j-bom-2.5.pom].



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)