This is an automated email from the ASF dual-hosted git repository.
sjaranowski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/maven-enforcer.git
The following commit(s) were added to refs/heads/master by this push:
new 79db9a3 [MENFORCER-469] Fix banTransitiveDependencies and transitive
dependencies with another version than the resolved one
79db9a3 is described below
commit 79db9a3babf2353ce91cf63d467082f06d918252
Author: Slawomir Jaranowski <[email protected]>
AuthorDate: Sat Mar 11 20:54:02 2023 +0100
[MENFORCER-469] Fix banTransitiveDependencies and transitive dependencies
with another version than the resolved one
- introduce methods:
- resolveTransitiveDependenciesVerbose
resolve with full tree contains all dependencies - also conflicted
- resolveTransitiveDependencies
resolve final tree contains dependencies after conflict resolved
---
.../rules/dependency/BannedDependenciesBase.java | 2 +-
.../rules/dependency/DependencyConvergence.java | 2 +-
.../rules/dependency/RequireUpperBoundDeps.java | 2 +-
.../enforcer/rules/dependency/ResolveUtil.java | 49 ++++++++++----
.../rules/dependency/BannedDependenciesTest.java | 4 +-
.../rules/dependency/RequireReleaseDepsTest.java | 17 +++--
.../dependency/RequireUpperBoundDepsTest.java | 2 +-
.../pom.xml | 70 +++++++++++++++++++
.../pom.xml | 69 +++++++++++++++++++
.../pom.xml | 79 ++++++++++++++++++++++
10 files changed, 268 insertions(+), 28 deletions(-)
diff --git
a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/BannedDependenciesBase.java
b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/BannedDependenciesBase.java
index 4ee240e..90691c2 100644
---
a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/BannedDependenciesBase.java
+++
b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/BannedDependenciesBase.java
@@ -102,7 +102,7 @@ abstract class BannedDependenciesBase extends
AbstractStandardEnforcerRule {
}
} else {
StringBuilder messageBuilder = new StringBuilder();
- DependencyNode rootNode =
resolveUtil.resolveTransitiveDependencies();
+ DependencyNode rootNode =
resolveUtil.resolveTransitiveDependenciesVerbose();
if (!validate(rootNode, 0, messageBuilder)) {
String message = "";
if (getMessage() != null) {
diff --git
a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/DependencyConvergence.java
b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/DependencyConvergence.java
index 4c6fbdd..b235b66 100644
---
a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/DependencyConvergence.java
+++
b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/DependencyConvergence.java
@@ -63,7 +63,7 @@ public final class DependencyConvergence extends
AbstractStandardEnforcerRule {
@Override
public void execute() throws EnforcerRuleException {
- DependencyNode node = resolveUtil.resolveTransitiveDependencies(
+ DependencyNode node = resolveUtil.resolveTransitiveDependenciesVerbose(
// TODO: use a modified version of ExclusionDependencySelector
to process excludes and includes
new DependencySelector() {
@Override
diff --git
a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/RequireUpperBoundDeps.java
b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/RequireUpperBoundDeps.java
index 27f7889..0a26be3 100644
---
a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/RequireUpperBoundDeps.java
+++
b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/RequireUpperBoundDeps.java
@@ -97,7 +97,7 @@ public final class RequireUpperBoundDeps extends
AbstractStandardEnforcerRule {
@Override
public void execute() throws EnforcerRuleException {
- DependencyNode node = resolveUtil.resolveTransitiveDependencies();
+ DependencyNode node =
resolveUtil.resolveTransitiveDependenciesVerbose();
upperBoundDepsVisitor = new RequireUpperBoundDepsVisitor()
.setUniqueVersions(uniqueVersions)
.setIncludes(includes);
diff --git
a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/ResolveUtil.java
b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/ResolveUtil.java
index 1337fed..19d4a20 100644
---
a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/ResolveUtil.java
+++
b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/ResolveUtil.java
@@ -39,14 +39,9 @@ import org.eclipse.aether.collection.DependencySelector;
import org.eclipse.aether.graph.DependencyNode;
import org.eclipse.aether.util.graph.manager.DependencyManagerUtils;
import org.eclipse.aether.util.graph.selector.AndDependencySelector;
-import org.eclipse.aether.util.graph.selector.ExclusionDependencySelector;
-import org.eclipse.aether.util.graph.selector.OptionalDependencySelector;
-import org.eclipse.aether.util.graph.selector.ScopeDependencySelector;
import org.eclipse.aether.util.graph.transformer.ConflictResolver;
import static java.util.Optional.ofNullable;
-import static org.apache.maven.artifact.Artifact.SCOPE_PROVIDED;
-import static org.apache.maven.artifact.Artifact.SCOPE_TEST;
/**
* Resolver helper class.
@@ -55,6 +50,7 @@ import static org.apache.maven.artifact.Artifact.SCOPE_TEST;
class ResolveUtil {
private final RepositorySystem repositorySystem;
+
private final MavenSession session;
/**
@@ -66,6 +62,24 @@ class ResolveUtil {
this.session = Objects.requireNonNull(session);
}
+ /**
+ * Retrieves the {@link DependencyNode} instance containing the result of
the transitive dependency
+ * for the current {@link MavenProject} in verbose mode.
+ * <p>
+ * In verbose mode all nodes participating in a conflict are retained.
+ * </p>
+ * <p>
+ * Please consult {@link ConflictResolver} and {@link
DependencyManagerUtils}>
+ * </p>
+ *
+ * @param selectors zero or more {@link DependencySelector} instances
+ * @return a Dependency Node which is the root of the project's dependency
tree
+ * @throws EnforcerRuleException thrown if the lookup fails
+ */
+ DependencyNode resolveTransitiveDependenciesVerbose(DependencySelector...
selectors) throws EnforcerRuleException {
+ return resolveTransitiveDependencies(true, selectors);
+ }
+
/**
* Retrieves the {@link DependencyNode} instance containing the result of
the transitive dependency
* for the current {@link MavenProject}.
@@ -75,13 +89,12 @@ class ResolveUtil {
* @throws EnforcerRuleException thrown if the lookup fails
*/
DependencyNode resolveTransitiveDependencies(DependencySelector...
selectors) throws EnforcerRuleException {
- if (selectors.length == 0) {
- selectors = new DependencySelector[] {
- new ScopeDependencySelector(SCOPE_TEST, SCOPE_PROVIDED),
- new OptionalDependencySelector(),
- new ExclusionDependencySelector()
- };
- }
+ return resolveTransitiveDependencies(false, selectors);
+ }
+
+ private DependencyNode resolveTransitiveDependencies(boolean verbose,
DependencySelector... selectors)
+ throws EnforcerRuleException {
+
try {
MavenProject project = session.getCurrentProject();
ArtifactTypeRegistry artifactTypeRegistry =
@@ -89,9 +102,15 @@ class ResolveUtil {
DefaultRepositorySystemSession repositorySystemSession =
new
DefaultRepositorySystemSession(session.getRepositorySession());
-
repositorySystemSession.setConfigProperty(ConflictResolver.CONFIG_PROP_VERBOSE,
true);
-
repositorySystemSession.setConfigProperty(DependencyManagerUtils.CONFIG_PROP_VERBOSE,
true);
- repositorySystemSession.setDependencySelector(new
AndDependencySelector(selectors));
+
+ if (selectors.length > 0) {
+ repositorySystemSession.setDependencySelector(new
AndDependencySelector(selectors));
+ }
+
+ if (verbose) {
+
repositorySystemSession.setConfigProperty(ConflictResolver.CONFIG_PROP_VERBOSE,
true);
+
repositorySystemSession.setConfigProperty(DependencyManagerUtils.CONFIG_PROP_VERBOSE,
true);
+ }
CollectRequest collectRequest = new CollectRequest(
project.getDependencies().stream()
diff --git
a/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/BannedDependenciesTest.java
b/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/BannedDependenciesTest.java
index 69ad445..1888357 100644
---
a/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/BannedDependenciesTest.java
+++
b/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/BannedDependenciesTest.java
@@ -94,7 +94,7 @@ class BannedDependenciesTest {
@Test
void excludesUseTransitiveDependencies() throws Exception {
- when(resolveUtil.resolveTransitiveDependencies())
+ when(resolveUtil.resolveTransitiveDependenciesVerbose())
.thenReturn(new DependencyNodeBuilder()
.withType(DependencyNodeBuilder.Type.POM)
.withChildNode(new DependencyNodeBuilder()
@@ -127,7 +127,7 @@ class BannedDependenciesTest {
@Test
void excludesAndIncludesUseTransitiveDependencies() throws Exception {
- when(resolveUtil.resolveTransitiveDependencies())
+ when(resolveUtil.resolveTransitiveDependenciesVerbose())
.thenReturn(new DependencyNodeBuilder()
.withType(DependencyNodeBuilder.Type.POM)
.withChildNode(new DependencyNodeBuilder()
diff --git
a/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/RequireReleaseDepsTest.java
b/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/RequireReleaseDepsTest.java
index b1409a6..5a0b76f 100644
---
a/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/RequireReleaseDepsTest.java
+++
b/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/RequireReleaseDepsTest.java
@@ -80,7 +80,7 @@ class RequireReleaseDepsTest {
@Test
void testSearchTransitiveMultipleFailures() throws Exception {
-
when(resolveUtil.resolveTransitiveDependencies()).thenReturn(getDependencyNodeWithMultipleSnapshots());
+
when(resolveUtil.resolveTransitiveDependenciesVerbose()).thenReturn(getDependencyNodeWithMultipleSnapshots());
rule.setSearchTransitive(true);
assertThatCode(rule::execute)
@@ -94,7 +94,7 @@ class RequireReleaseDepsTest {
@Test
void testSearchTransitiveNoFailures() throws Exception {
when(session.getCurrentProject()).thenReturn(project);
- when(resolveUtil.resolveTransitiveDependencies()).thenReturn(new
DependencyNodeBuilder().build());
+
when(resolveUtil.resolveTransitiveDependenciesVerbose()).thenReturn(new
DependencyNodeBuilder().build());
rule.setSearchTransitive(true);
assertThatCode(rule::execute).doesNotThrowAnyException();
@@ -114,7 +114,8 @@ class RequireReleaseDepsTest {
@Test
void testWildcardExcludeTests() throws Exception {
when(session.getCurrentProject()).thenReturn(project);
-
when(resolveUtil.resolveTransitiveDependencies()).thenReturn(getDependencyNodeWithMultipleTestSnapshots());
+ when(resolveUtil.resolveTransitiveDependenciesVerbose())
+ .thenReturn(getDependencyNodeWithMultipleTestSnapshots());
rule.setExcludes(Collections.singletonList("*:*:*:*:test"));
rule.setSearchTransitive(true);
@@ -125,7 +126,8 @@ class RequireReleaseDepsTest {
@Test
void testWildcardExcludeAll() throws Exception {
when(session.getCurrentProject()).thenReturn(project);
-
when(resolveUtil.resolveTransitiveDependencies()).thenReturn(getDependencyNodeWithMultipleTestSnapshots());
+ when(resolveUtil.resolveTransitiveDependenciesVerbose())
+ .thenReturn(getDependencyNodeWithMultipleTestSnapshots());
rule.setExcludes(Collections.singletonList("*"));
rule.setSearchTransitive(true);
@@ -135,7 +137,8 @@ class RequireReleaseDepsTest {
@Test
void testExcludesAndIncludes() throws Exception {
-
when(resolveUtil.resolveTransitiveDependencies()).thenReturn(getDependencyNodeWithMultipleTestSnapshots());
+ when(resolveUtil.resolveTransitiveDependenciesVerbose())
+ .thenReturn(getDependencyNodeWithMultipleTestSnapshots());
rule.setExcludes(Collections.singletonList("*"));
rule.setIncludes(Collections.singletonList("*:*:*:*:test"));
@@ -161,7 +164,7 @@ class RequireReleaseDepsTest {
void testFailWhenParentIsSnapshot() throws Exception {
when(session.getCurrentProject()).thenReturn(project);
when(project.getParentArtifact()).thenReturn(ARTIFACT_STUB_FACTORY.getSnapshotArtifact());
- when(resolveUtil.resolveTransitiveDependencies()).thenReturn(new
DependencyNodeBuilder().build());
+
when(resolveUtil.resolveTransitiveDependenciesVerbose()).thenReturn(new
DependencyNodeBuilder().build());
rule.setFailWhenParentIsSnapshot(true);
@@ -174,7 +177,7 @@ class RequireReleaseDepsTest {
void parentShouldBeExcluded() throws Exception {
when(session.getCurrentProject()).thenReturn(project);
when(project.getParentArtifact()).thenReturn(ARTIFACT_STUB_FACTORY.getSnapshotArtifact());
- when(resolveUtil.resolveTransitiveDependencies()).thenReturn(new
DependencyNodeBuilder().build());
+
when(resolveUtil.resolveTransitiveDependenciesVerbose()).thenReturn(new
DependencyNodeBuilder().build());
rule.setFailWhenParentIsSnapshot(true);
rule.setExcludes(Collections.singletonList("testGroupId:*"));
diff --git
a/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/RequireUpperBoundDepsTest.java
b/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/RequireUpperBoundDepsTest.java
index 5cbbe30..0cdd221 100644
---
a/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/RequireUpperBoundDepsTest.java
+++
b/enforcer-rules/src/test/java/org/apache/maven/enforcer/rules/dependency/RequireUpperBoundDepsTest.java
@@ -41,7 +41,7 @@ class RequireUpperBoundDepsTest {
@Test
void testRule() throws Exception {
- when(resolveUtil.resolveTransitiveDependencies())
+ when(resolveUtil.resolveTransitiveDependenciesVerbose())
.thenReturn(new DependencyNodeBuilder()
.withType(DependencyNodeBuilder.Type.POM)
.withChildNode(new DependencyNodeBuilder()
diff --git
a/maven-enforcer-plugin/src/it/projects/ban-transitive-dependencies-direct-dep1/pom.xml
b/maven-enforcer-plugin/src/it/projects/ban-transitive-dependencies-direct-dep1/pom.xml
new file mode 100644
index 0000000..01a1d9b
--- /dev/null
+++
b/maven-enforcer-plugin/src/it/projects/ban-transitive-dependencies-direct-dep1/pom.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+<project>
+ <modelVersion>4.0.0</modelVersion>
+
+ <groupId>org.apache.maven.its.enforcer</groupId>
+ <artifactId>ban-transitive-test</artifactId>
+ <version>1.0</version>
+
+ <url>https://issues.apache.org/jira/browse/MENFORCER-469</url>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-enforcer-plugin</artifactId>
+ <version>@project.version@</version>
+ <executions>
+ <execution>
+ <id>test</id>
+ <goals>
+ <goal>enforce</goal>
+ </goals>
+ <configuration>
+ <rules>
+ <banTransitiveDependencies/>
+ </rules>
+ </configuration>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
+
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.maven.plugins.enforcer.its</groupId>
+ <artifactId>menforcer128_classic</artifactId>
+ <version>0.9.9</version>
+ </dependency>
+
+ <!-- menforcer128_api the same version as in menforcer128_classic -->
+
+ <dependency>
+ <groupId>org.apache.maven.plugins.enforcer.its</groupId>
+ <artifactId>menforcer128_api</artifactId>
+ <version>1.5.0</version>
+ </dependency>
+ </dependencies>
+
+</project>
diff --git
a/maven-enforcer-plugin/src/it/projects/ban-transitive-dependencies-direct-dep2/pom.xml
b/maven-enforcer-plugin/src/it/projects/ban-transitive-dependencies-direct-dep2/pom.xml
new file mode 100644
index 0000000..ad69e5a
--- /dev/null
+++
b/maven-enforcer-plugin/src/it/projects/ban-transitive-dependencies-direct-dep2/pom.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+<project>
+ <modelVersion>4.0.0</modelVersion>
+
+ <groupId>org.apache.maven.its.enforcer</groupId>
+ <artifactId>ban-transitive-test</artifactId>
+ <version>1.0</version>
+
+ <url>https://issues.apache.org/jira/browse/MENFORCER-469</url>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-enforcer-plugin</artifactId>
+ <version>@project.version@</version>
+ <executions>
+ <execution>
+ <id>test</id>
+ <goals>
+ <goal>enforce</goal>
+ </goals>
+ <configuration>
+ <rules>
+ <banTransitiveDependencies/>
+ </rules>
+ </configuration>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
+
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.maven.plugins.enforcer.its</groupId>
+ <artifactId>menforcer128_classic</artifactId>
+ <version>0.9.9</version>
+ </dependency>
+
+ <!-- menforcer128_api override version, in menforcer128_classic is 1.5.0
-->
+ <dependency>
+ <groupId>org.apache.maven.plugins.enforcer.its</groupId>
+ <artifactId>menforcer128_api</artifactId>
+ <version>1.6.0</version>
+ </dependency>
+ </dependencies>
+
+</project>
diff --git
a/maven-enforcer-plugin/src/it/projects/ban-transitive-dependencies-direct-dep3/pom.xml
b/maven-enforcer-plugin/src/it/projects/ban-transitive-dependencies-direct-dep3/pom.xml
new file mode 100644
index 0000000..64dd515
--- /dev/null
+++
b/maven-enforcer-plugin/src/it/projects/ban-transitive-dependencies-direct-dep3/pom.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+<project>
+ <modelVersion>4.0.0</modelVersion>
+
+ <groupId>org.apache.maven.its.enforcer</groupId>
+ <artifactId>ban-transitive-test</artifactId>
+ <version>1.0</version>
+
+ <url>https://issues.apache.org/jira/browse/MENFORCER-469</url>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-enforcer-plugin</artifactId>
+ <version>@project.version@</version>
+ <executions>
+ <execution>
+ <id>test</id>
+ <goals>
+ <goal>enforce</goal>
+ </goals>
+ <configuration>
+ <rules>
+ <banTransitiveDependencies />
+ </rules>
+ </configuration>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
+
+ <dependencyManagement>
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.maven.plugins.enforcer.its</groupId>
+ <artifactId>menforcer128_api</artifactId>
+ <version>1.6.0</version>
+ </dependency>
+ </dependencies>
+ </dependencyManagement>
+
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.maven.plugins.enforcer.its</groupId>
+ <artifactId>menforcer128_classic</artifactId>
+ <version>0.9.9</version>
+ </dependency>
+
+ <!-- menforcer128_api override version, in menforcer128_classic is 1.5.0
-->
+ <!-- managed version -->
+ <dependency>
+ <groupId>org.apache.maven.plugins.enforcer.its</groupId>
+ <artifactId>menforcer128_api</artifactId>
+ </dependency>
+ </dependencies>
+
+</project>
