On 20 Mar 2012, at 22:59, Brian Pontarelli wrote: > I looked briefly in the archives and didn't find anything. If I missed it let > me know. > > I'm wondering why the main Guice artifacts in Maven central depend on Sisu > directly?
Which artifact (ie. exact GAV coordinate) and which dependency? Are you talking about the 3.0 dependency on org.sonatype.sisu.inject:cglib ? That artifact is the same as the cglib-2.2.1-snapshot.jar included in the Ant distribution. Maven releases cannot depend on snapshots, and the cglib project at the time was not ready to do a release to Maven central. Since I already had a staged release of this code (with the timestamp 2.2.1-v20090111) for my sisu-guice build, rather than delaying the release of guice 3.0 (which people were already eagerly waiting for) I suggested the official guice pom could use the same artifact. Sam and I also spent a lot of time making sure that the content of the build produced by the Ant and Maven builds were identical - part of this relied on both cglib jars (Maven vs Ant) being built from the same timestamped code from the cglib source repository. As soon as cglib did an official release of 2.2.2 to Maven central we updated trunk to use that dependency: http://code.google.com/p/google-guice/source/detail?r=e7511fd1568d6799ab104c72446080c54480f4a9. > I don't think this is correct since the official ZIP file distribution you > download from the Guice Google code project does not include that JAR. The ZIP file distribution doesn't contain cglib-2.2.1-snapshot.jar because it's jarjar'd into the main jar. Similarly the cglib dependency is marked as optional in the pom by default (under the jarjar profile) because it gets jarjar'd into the final jar, meaning that projects depending on guice should not be affected by this dependency. > Additionally, as I was reading through the POM in Maven central for > com.google.inject:guice:3.0 it looked like not only does this depend on Sisu > directly as a compile time dependency, but it also states that Guice JarJar's > Sisu at some point during the build. Taking a quick look at the official > Guice JARs, there aren't any sisu packages or classes in there. It jarjars cglib - the groupId just happens to contain sisu because this was a timestamped interim release of cglib to get guice 3.0 out the door. > This appears to bring up a few questions: > > 1. Am I missing something? See above > 2. Is someone besides the Guice committers managing the POM? No > 3. Is someone attempting to promote Sisu through Guice? No > 4. Can we safely remove that dependency and clean up the POM? The pom in trunk does not contain that dependency (it depends on the recent cglib:cglib release) You can't go back and modify releases on central, but you can do another release - however, since the dependency is optional it should not be affecting you (is it actually causing a build problem?) > -bp > > -- > You received this message because you are subscribed to the Google Groups > "google-guice" group. > To post to this group, send email to [email protected]. > To unsubscribe from this group, send email to > [email protected]. > For more options, visit this group at > http://groups.google.com/group/google-guice?hl=en. > -- You received this message because you are subscribed to the Google Groups "google-guice" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/google-guice?hl=en.
