[M2] How to turn off transitive dependencies?

[Carsten Ziegeler <cz...@apache.org>]

Is there any way to turn off transitive dependencies? Or do I have to
find the dependency which has "wrong dependencies" and explicitly exlude
the "wrong" one there?

Carsten
-- 
Carsten Ziegeler - Open Source Group, S&N AG
http://www.s-und-n.de
http://www.osoco.org/weblogs/rael/

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org

Re: [M2] How to turn off transitive dependencies?

[Carsten Ziegeler <cz...@apache.org>]

Carsten Ziegeler wrote:
> 1) Avalon framework. Up to version 4.1.0 (or something) Avalon had one
> big jar: the avalon framework. Then starting with 4.1.1 they splitt this
> into two jar files: api and impl. But for convenience they provide both
> versions, so for example, you have
> avalon-framework-4.2.0.jar
> avalon-framework-api-4.2.0.jar
> avalon-framework-impl-4.2.0.jar
> 
> Now Cocoon depends on 4.2.0 api and impl which of course works fine. We
> use several other projects, that depend on avalon-framework-4.1.5. As
> this is a different identifier for the jar we end up with
> avalon-framework-4.1.5 and api/impl from 4.2.0 resulting in errors as
> 4.1.5 is loaded before the other two jars! (Compilation works fine of
> course).
> All poms are imho correct. And there are several projects having these
> different dependencies. So everywhere specifying exclude statements
> can't be the solution.
> 
Just in addition, a similar problem exists with Ant. Up to 1.5.x Ant
provided two jars, ant and ant-optional. From 1.6 Ant splitted up the
optinal jar into several ones. Now if your project depends on ant 1.6.5
and let's say ant-optional-trax-1.6.5 while a project you depend on,
depends on ant-optional.1.5.3 again you have all three jars resulting in
errors at runtime.

Carsten
-- 
Carsten Ziegeler - Open Source Group, S&N AG
http://www.s-und-n.de
http://www.osoco.org/weblogs/rael/


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org

Re: [M2] How to turn off transitive dependencies?

[Carsten Ziegeler <cz...@apache.org>]

Brett Porter wrote:
> Carsten Ziegeler wrote:
> 
> 
>>1) Avalon framework. Up to version 4.1.0 (or something) Avalon had one
>>big jar: the avalon framework. Then starting with 4.1.1 they splitt this
>>into two jar files: api and impl. But for convenience they provide both
>>versions, so for example, you have
>> 
>>
> 
> Yep, I understand this is the case here. We're actually planning a
> "supercedes" attribute in a future version so that both api and impl can
> declare that they shold block an earlier version of just "framework".
> 
Hmm, ok, this works for new releases; but I'm wondering if really all
old poms will be converted and corrected.

> 
> Absolutely - we've got the solutions in there in the cases where they
> are needed, I'd just advocate considering your position first and using
> them as a last resort. I think this is especially important for projects
> like Cocoon where you are depended upon by lots of projects, as the
> quality of your POMs affects everyone else. For example, if you block
> out dependencies you think are optional but which aren't under certain
> circumstances then that will affect other projects.
> 
:) Yes, Cocoon depends on more than 130 jars; I'm trying to migrate the
core of Cocoon to m2 and the core uses only about 40 jars and we are
affected by several "wrong" poms. It will take ages to correct them all.
As we are currently using Ant to build Cocoon, today we know exactly
which libs are requried in what version - and of course Cocoon runs fine
:). With m2 we loose this power. Now, don't get me wrong I really like
this transitive dependency handling and it will be a great improvement,
but I don't get Cocoon running just because of this :( - and we all
agree that poms can always be "wrong" in one way or the other.

> Anyway, I hope we've got everything necessary to help you along with this.
Hmm, so what can I do today? We currently have the three problems
described (avalon, servletapi and ant).

Thanks
Carsten

-- 
Carsten Ziegeler - Open Source Group, S&N AG
http://www.s-und-n.de
http://www.osoco.org/weblogs/rael/

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org

Re: [M2] How to turn off transitive dependencies?

[Brett Porter <br...@apache.org>]

Carsten Ziegeler wrote:

>1) Avalon framework. Up to version 4.1.0 (or something) Avalon had one
>big jar: the avalon framework. Then starting with 4.1.1 they splitt this
>into two jar files: api and impl. But for convenience they provide both
>versions, so for example, you have
>  
>
Yep, I understand this is the case here. We're actually planning a
"supercedes" attribute in a future version so that both api and impl can
declare that they shold block an earlier version of just "framework".

>Now, you can
>guess what happens, we end up with the servletapi in the WEB-INF/lib
>directory, just because of the transitive dependency.
>  
>
Right, its definitely a reason to allow local overriding of the scope.

>In fact I think one of the biggest problems are unique identifier for
>artifacts. I guess you have already discussed this. 
>
We have some degree of control over what gets into the repository. As
long as we are diligent with upload requests, and there are good
policies for those that automatically sync in like the ASF, it should be
ok. We'll definitely push to migrate to FQN groups after m2's release as
it is much easier to control that namespace.

>So I agree that theoretically it shouldn't be required but practically
>it will be. :)
>  
>
Absolutely - we've got the solutions in there in the cases where they
are needed, I'd just advocate considering your position first and using
them as a last resort. I think this is especially important for projects
like Cocoon where you are depended upon by lots of projects, as the
quality of your POMs affects everyone else. For example, if you block
out dependencies you think are optional but which aren't under certain
circumstances then that will affect other projects.

Anyway, I hope we've got everything necessary to help you along with this.

Cheers,
Brett



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org

Re: [M2] How to turn off transitive dependencies?

[Carsten Ziegeler <cz...@apache.org>]

Brett Porter wrote:
> Currently, no there isn't a way to do this.
> 
> I've got something on the list for beta-1 to make this possible (see
> inclusions), but it is highly recommended that you track the problem and
> have it fixed. We've been really reluctant to add this because
> technically it shouldn't be required and because it will certainly
> become a crutch and we'll stop getting feedback on bad poms.
> 
> What are you experiencing problems with?
> 
I don't think that this is just because of bad poms. Current in Cocoon
we face two problems:
1) Avalon framework. Up to version 4.1.0 (or something) Avalon had one
big jar: the avalon framework. Then starting with 4.1.1 they splitt this
into two jar files: api and impl. But for convenience they provide both
versions, so for example, you have
avalon-framework-4.2.0.jar
avalon-framework-api-4.2.0.jar
avalon-framework-impl-4.2.0.jar

Now Cocoon depends on 4.2.0 api and impl which of course works fine. We
use several other projects, that depend on avalon-framework-4.1.5. As
this is a different identifier for the jar we end up with
avalon-framework-4.1.5 and api/impl from 4.2.0 resulting in errors as
4.1.5 is loaded before the other two jars! (Compilation works fine of
course).
All poms are imho correct. And there are several projects having these
different dependencies. So everywhere specifying exclude statements
can't be the solution.

2) servletapi.jar. Now, we depend on this jar, but it shouldn't go into
the webapp. Fortunately this is possible and works. Unfortunately we
depend on onther project that depends on the servletapi where it's not
specified that the jar should not go into the webapp, because that
project doesn't provide a webapp, it's just a framework. Now, you can
guess what happens, we end up with the servletapi in the WEB-INF/lib
directory, just because of the transitive dependency.

Sure, if all poms all over the world would be correct (whatever that
means) these problems can be avoided. But I don't think that this will
ever really happen. Basically I think the transitive dependencies are a
good idea, but I would like to turn them off and then perhaps get a
warning if some dependency might be missing.

In fact I think one of the biggest problems are unique identifier for
artifacts. I guess you have already discussed this. As long as everyone
can pick up an identifier he thinks is good, POMs will never be perfect.
Look at the xml-apis mess or projects like jakarta regexp where the
group id is just regexp, or projects using different ids, like avalon
logkit (using just logkit, excalibur-logkit and god knows what else).

So I agree that theoretically it shouldn't be required but practically
it will be. :)

Carsten
-- 
Carsten Ziegeler - Open Source Group, S&N AG
http://www.s-und-n.de
http://www.osoco.org/weblogs/rael/

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org

Re: [M2] How to turn off transitive dependencies?

[Brett Porter <br...@apache.org>]

Currently, no there isn't a way to do this.

I've got something on the list for beta-1 to make this possible (see
inclusions), but it is highly recommended that you track the problem and
have it fixed. We've been really reluctant to add this because
technically it shouldn't be required and because it will certainly
become a crutch and we'll stop getting feedback on bad poms.

What are you experiencing problems with?

- Brett

Carsten Ziegeler wrote:

>Is there any way to turn off transitive dependencies? Or do I have to
>find the dependency which has "wrong dependencies" and explicitly exlude
>the "wrong" one there?
>
>Carsten
>  
>


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org