You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by vy...@apache.org on 2024/10/10 14:50:31 UTC
(logging-parent) branch fix/main/bom created (now 2572615)
This is an automated email from the ASF dual-hosted git repository.
vy pushed a change to branch fix/main/bom
in repository https://gitbox.apache.org/repos/asf/logging-parent.git
at 2572615 Change BOM activation and stop managing dependencies
This branch includes the following new commits:
new 2572615 Change BOM activation and stop managing dependencies
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(logging-parent) 01/01: Change BOM activation and stop managing dependencies
Posted by vy...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
vy pushed a commit to branch fix/main/bom
in repository https://gitbox.apache.org/repos/asf/logging-parent.git
commit 2572615181ca65d82c485f3c011be9181e11aa97
Author: Volkan Yazıcı <vo...@yazi.ci>
AuthorDate: Thu Oct 10 16:51:14 2024 +0200
Change BOM activation and stop managing dependencies
---
pom.xml | 165 +++++++++++----------
...potbugs_maven_plugin.xml => bom_activation.xml} | 6 +-
src/changelog/.11.x.x/bom_deps.xml | 15 ++
3 files changed, 102 insertions(+), 84 deletions(-)
diff --git a/pom.xml b/pom.xml
index 0018f5a..09293ef 100644
--- a/pom.xml
+++ b/pom.xml
@@ -206,15 +206,9 @@
<!-- dependency versions -->
<org.eclipse.jgit.version>7.0.0.202409031743-r</org.eclipse.jgit.version>
<!-- These are annotation with a retention of CLASS. They can be freely upgraded. -->
- <bnd.annotation.version>7.0.0</bnd.annotation.version>
- <jspecify.version>1.0.0</jspecify.version>
<node.version>21.7.1</node.version>
<npm.version>10.5.0</npm.version>
- <osgi.annotation.version>8.1.0</osgi.annotation.version>
- <osgi.annotation.bundle.version>2.0.0</osgi.annotation.bundle.version>
- <osgi.annotation.versioning.version>1.1.2</osgi.annotation.versioning.version>
<palantir-java-format.version>2.50.0</palantir-java-format.version>
- <spotbugs-annotations.version>4.8.6</spotbugs-annotations.version>
<!-- plugin versions -->
<asciidoctor-maven-plugin.version>3.0.0</asciidoctor-maven-plugin.version>
@@ -254,41 +248,14 @@
<dependencyManagement>
<dependencies>
- <dependency>
- <groupId>biz.aQute.bnd</groupId>
- <artifactId>biz.aQute.bnd.annotation</artifactId>
- <version>${bnd.annotation.version}</version>
- </dependency>
+ <!-- ██ ██ █████ ██████ ███ ██ ██ ███ ██ ██████ ██
+ ██ ██ ██ ██ ██ ██ ████ ██ ██ ████ ██ ██ ██
+ ██ █ ██ ███████ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ███ ██
+ ██ ███ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
+ ███ ███ ██ ██ ██ ██ ██ ████ ██ ██ ████ ██████ ██
- <dependency>
- <groupId>com.github.spotbugs</groupId>
- <artifactId>spotbugs-annotations</artifactId>
- <version>${spotbugs-annotations.version}</version>
- </dependency>
-
- <dependency>
- <groupId>org.jspecify</groupId>
- <artifactId>jspecify</artifactId>
- <version>${jspecify.version}</version>
- </dependency>
-
- <dependency>
- <groupId>org.osgi</groupId>
- <artifactId>osgi.annotation</artifactId>
- <version>${osgi.annotation.version}</version>
- </dependency>
-
- <dependency>
- <groupId>org.osgi</groupId>
- <artifactId>org.osgi.annotation.bundle</artifactId>
- <version>${osgi.annotation.bundle.version}</version>
- </dependency>
-
- <dependency>
- <groupId>org.osgi</groupId>
- <artifactId>org.osgi.annotation.versioning</artifactId>
- <version>${osgi.annotation.versioning.version}</version>
- </dependency>
+ Do not add entries to this `dependencyManagement > dependencies` block!
+ Otherwise they leak into BOMs: https://github.com/apache/logging-log4j2/issues/3066 -->
</dependencies>
</dependencyManagement>
@@ -442,47 +409,6 @@
<phase>clean</phase>
</execution>
- <!-- BOMs should ideally _only_ contain dependencies for modules of the project.
- No invasive properties or plugin/dependency management – either from the BOM itself or its parent.
- The following `flatten-maven-plugin` exactly performs that trimming operation. -->
- <execution>
- <id>flatten-bom</id>
- <goals>
- <goal>flatten</goal>
- </goals>
- <!-- BOM flattening is disabled by default!
- This execution must be manually enabled by the consumer. -->
- <phase>none</phase>
- <configuration>
- <flattenMode>bom</flattenMode>
- <!-- POM `ElementHandling` is pretty cryptic: https://www.mojohaus.org/flatten-maven-plugin/apidocs/org/codehaus/mojo/flatten/ElementHandling.html
- Trial-and-error has shown that we should use either `remove` or `interpolate`.
- `remove` simply removes the element.
- `interpolate` takes the element from the original POM with variables interpolated.
- Avoid using `resolve`, which uses the effective POM where inherited changes from the parent are also incorporated. -->
- <pomElements>
- <build>remove</build>
- <properties>remove</properties>
- <repositories>remove</repositories>
- <distributionManagement>remove</distributionManagement>
- <dependencyManagement>interpolate</dependencyManagement>
- <!-- Keep the `parent`!
- Otherwise, this causes build failures for artifacts whose dependencies need to be resolved at runtime.
- Consider the following problem experienced in `log4j-transform-maven-plugin`:
-
- 1. `log4j-transform-parent` depends on `log4j-transform-bom`
- 2. `log4j-transform-bom` depends on `logging-parent`
- 3. `logging-parent` contains `dependencyManagement`, etc. that are used by `log4j-transform-maven-plugin`
- 4. Dependencies of `log4j-transform-maven-plugin` et al. is resolved *at runtime*
- 5. Though at runtime, the deployed `log4j-transform-bom` is used, which is flattened and hence doesn't have a parent!
- 6. Hence, at runtime, all `logging-parent` logic is lost
-
- To avoid this, parents should better be kept while flattening BOMs. -->
- <parent>keep</parent>
- </pomElements>
- </configuration>
- </execution>
-
</executions>
</plugin>
@@ -1018,6 +944,83 @@
<profiles>
+ <!-- `bom` profile to generate BOMs -->
+ <profile>
+
+ <id>bom</id>
+
+ <!-- Profile gets activated using a file instead of, say, a property defined by the child `pom.xml`.
+ Since a Maven property lookup requires model interpolation and that happens after the profile activation phase.
+ See: https://maven.apache.org/ref/3.9.6/maven-model-builder -->
+ <activation>
+ <file>
+ <exists>.logging-parent-bom-activator</exists>
+ </file>
+ </activation>
+
+ <build>
+ <plugins>
+
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>flatten-maven-plugin</artifactId>
+ <executions>
+
+ <!-- Explicitly specifying the `flatten-revision` execution to set its order in execution -->
+ <execution>
+ <id>flatten-revision</id>
+ </execution>
+
+ <!-- BOMs should ideally _only_ contain dependencies for modules of the project.
+ No invasive properties or plugin/dependency management – either from the BOM itself or its parent.
+ The following execution exactly performs that trimming operation. -->
+ <execution>
+ <id>flatten-bom</id>
+ <goals>
+ <goal>flatten</goal>
+ </goals>
+ <phase>process-resources</phase>
+ <configuration>
+ <flattenMode>bom</flattenMode>
+ <!-- POM `ElementHandling` is pretty cryptic: https://www.mojohaus.org/flatten-maven-plugin/apidocs/org/codehaus/mojo/flatten/ElementHandling.html
+ Trial-and-error has shown that we should use either `remove` or `interpolate`.
+ `remove` simply removes the element.
+ `interpolate` takes the element from the original POM with variables interpolated.
+ Avoid using `resolve`, which uses the effective POM where inherited changes from the parent are also incorporated. -->
+ <pomElements>
+ <build>remove</build>
+ <dependencyManagement>interpolate</dependencyManagement>
+ <distributionManagement>remove</distributionManagement>
+ <profiles>remove</profiles>
+ <properties>remove</properties>
+ <repositories>remove</repositories>
+ <!-- Keep the `parent`!
+ Otherwise, this causes build failures for artifacts whose dependencies need to be resolved at runtime.
+ Consider the following problem experienced in `log4j-changelog-maven-plugin`:
+
+ 1. `log4j-changelog-maven-plugin` depends on `log4j-changelog`
+ 2. `log4j-changelog` inherits from `log4j-tools-parent`
+ 3. `log4j-tools-parent` inherits from `log4j-tools-bom`
+ 4. `log4j-tools-bom` inherits from `logging-parent`
+ 5. `logging-parent` contains `dependencyManagement`, etc. entries that are used by `log4j-changelog-maven-plugin`
+ 6. Dependencies of `log4j-changelog-maven-plugin` et al. is resolved *at runtime*
+ 7. Though at runtime, the deployed `log4j-tools-bom` is used, which is flattened and hence doesn't have a parent!
+ 8. Hence, at runtime, `log4j-transform-maven-plugin` execution fails due to missing logic that should have been inherited from `logging-parent`
+
+ To avoid this, parents should better be kept while flattening BOMs. -->
+ <parent>keep</parent>
+ </pomElements>
+ </configuration>
+ </execution>
+
+ </executions>
+ </plugin>
+
+ </plugins>
+ </build>
+
+ </profile>
+
<!-- `changelog-validate` profile to validate changelog XMLs -->
<profile>
diff --git a/src/changelog/.11.x.x/update_com_github_spotbugs_spotbugs_maven_plugin.xml b/src/changelog/.11.x.x/bom_activation.xml
similarity index 52%
rename from src/changelog/.11.x.x/update_com_github_spotbugs_spotbugs_maven_plugin.xml
rename to src/changelog/.11.x.x/bom_activation.xml
index 73429c4..0f8bf7f 100644
--- a/src/changelog/.11.x.x/update_com_github_spotbugs_spotbugs_maven_plugin.xml
+++ b/src/changelog/.11.x.x/bom_activation.xml
@@ -2,7 +2,7 @@
<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="https://logging.apache.org/xml/ns"
xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
- type="updated">
- <issue id="248" link="https://github.com/apache/logging-parent/pull/248"/>
- <description format="asciidoc">Update `com.github.spotbugs:spotbugs-maven-plugin` to version `4.8.6.4`</description>
+ type="changed">
+ <issue id="265" link="https://github.com/apache/logging-parent/pull/265"/>
+ <description format="asciidoc">Activate `flatten-bom` execution of `flatten-maven-plugin` using a `.logging-parent-bom-activator` file</description>
</entry>
diff --git a/src/changelog/.11.x.x/bom_deps.xml b/src/changelog/.11.x.x/bom_deps.xml
new file mode 100644
index 0000000..231fcf5
--- /dev/null
+++ b/src/changelog/.11.x.x/bom_deps.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns="https://logging.apache.org/xml/ns"
+ xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+ type="removed">
+ <issue id="265" link="https://github.com/apache/logging-parent/pull/265"/>
+ <issue id="apache/logging-log4j2#3066" link="https://github.com/apache/logging-log4j2/issues/3066"/>
+ <description format="asciidoc">Remove following managed dependencies to avoid polluting BOMs:
+** `biz.aQute.bnd:biz.aQute.bnd.annotation`
+** `com.github.spotbugs:spotbugs-annotations`
+** `org.jspecify:jspecify`
+** `org.osgi:osgi.annotation`
+** `org.osgi:org.osgi.annotation.bundle`
+** `org.osgi:org.osgi.annotation.versioning`</description>
+</entry>