Justin Leet created METRON-734:
----------------------------------
Summary: Builds failing because of MaxMind DB transitive dependency
Key: METRON-734
URL: https://issues.apache.org/jira/browse/METRON-734
Project: Metron
Issue Type: Bug
Reporter: Justin Leet
Assignee: Justin Leet
Original Error
{code}
[ERROR] Failed to execute goal on project metron-enrichment: Could not resolve
dependencies for project org.apache.metron:metron-enrichment:jar:0.3.1: Failed
to collect dependencies at com.maxmind.geoip2:geoip2:jar:2.8.0 ->
com.maxmind.db:maxmind-db:jar:1.2.1 ->
com.fasterxml.jackson.core:jackson-databind:jar:2.9.0-SNAPSHOT: Failed to read
artifact descriptor for
com.fasterxml.jackson.core:jackson-databind:jar:2.9.0-SNAPSHOT: Failure to find
com.fasterxml:oss-parent:pom:28 in http://clojars.org/repo was cached in the
local repository, resolution will not be reattempted until the update interval
of clojars.org has elapsed or updates are forced -> [Help 1]
{code}
The geoip2 lib from MaxMind has a transitive dependency on open ended version
range of jackson-databind. This causes it to try to use 2.9.0-SNAPSHOT, rather
than a distinct version.
The easy answer is to just exclude jackson from being pulled in by geoip2 lib,
and use our own. The catch is that the version geoip declares in its POM is
higher than the version we use and I don't know if that causes any problems
(I'm guessing not, since it's going from 2.7.x to 2.8.x, but I haven't tested
it).
If there's a way to skip snapshots that might also contribute to solving our
problem, but I still don't like the unrepeatability of the build if they depend
on an open ended range.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
