[
https://issues.apache.org/jira/browse/GROOVY-12199?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18099253#comment-18099253
]
ASF GitHub Bot commented on GROOVY-12199:
-----------------------------------------
sonarqubecloud[bot] commented on PR #2740:
URL: https://github.com/apache/groovy/pull/2740#issuecomment-5083216450
## [](https://sonarcloud.io/dashboard?id=apache_groovy&pullRequest=2740)
**Quality Gate passed**
Issues
 [0 New
issues](https://sonarcloud.io/project/issues?id=apache_groovy&pullRequest=2740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted
issues](https://sonarcloud.io/project/issues?id=apache_groovy&pullRequest=2740&issueStatuses=ACCEPTED)
Measures
 [0 Security
Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_groovy&pullRequest=2740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New
Code](https://sonarcloud.io/component_measures?id=apache_groovy&pullRequest=2740&metric=new_coverage&view=list)
 [0.0% Duplication on New
Code](https://sonarcloud.io/component_measures?id=apache_groovy&pullRequest=2740&metric=new_duplicated_lines_density&view=list)
<!
> Replace ant-jarjar with com.gradleup.shadow for package relocation
> ------------------------------------------------------------------
>
> Key: GROOVY-12199
> URL: https://issues.apache.org/jira/browse/GROOVY-12199
> Project: Groovy
> Issue Type: Improvement
> Reporter: Daniel Sun
> Priority: Major
>
> h2. Motivation
> Published Groovy jars shade ASM, the ANTLR runtime, and picocli into packages
> under the {{groovyjarjar}} prefix so those libraries do not clash with
> application-chosen versions on the classpath.
> Today that shading is driven by {{com.eed3si9n.jarjar:ant-jarjar}} through an
> Ant {{taskdef}} in {{{}JarJarTask{}}}. The tool is no longer the maintained
> mainstream for Gradle package relocation; {{com.gradleup.shadow}} is. This
> change swaps the engine while {*}keeping the published jar surface
> compatible{*}.
> h2. Goals
> * Replace ant-jarjar with {{com.gradleup.shadow}}
> ({{{}shadow-gradle-plugin{}}} 9.6.1) for package relocation.
> * Preserve published-artefact behaviour:
> ** {{groovyjarjar}} package prefixes (e.g. {{{}groovyjarjarasm{}}},
> {{{}groovyjarjarantlr4{}}}, {{{}groovyjarjarpicocli{}}})
> ** OSGi manifest generation (BND via the root {{osgi}} extension)
> ** {{META-INF/INDEX.LIST}} and fixed timestamps for reproducible builds
> ** {{untouchedFiles}} (e.g. {{CliBuilder}} classes that must not be
> relocated)
> * Rename build machinery so names match the tool and the existing
> {{repackagedDependencies}} DSL:
> ** {{JarJarTask}} → {{RepackageJarTask}}
> ** task {{jarjar}} → {{repackageJar}}
> * Drop the {{tools}} dependency on ant-jarjar and the {{jarjar}} entry in
> {{{}versions.properties{}}}; refresh {{{}gradle/verification-metadata.xml{}}}.
> h2. Non-goals / compatibility contract
> * *Do not* rename {{groovyjarjar}} packages — they are part of the published
> binary surface.
> * *Do not* rename distribution license/notice snippets such as
> {{LICENSE-JARJAR}} / {{NOTICE-JARJAR}} — those describe the *contents* of the
> shaded artefact, not the build engine.
> * Build-only rename: task and class names change; consumers of published
> jars are unaffected.
> h2. Approach
> * Introduce {{RepackageJarTask}} extending Shadow's {{{}ShadowJar{}}}.
> * Feed only the base jar ({{{}inputJar{}}}) plus explicitly selected
> {{{}repackagedLibraries{}}}; never pull the whole {{runtimeClasspath}} into
> the shade.
> * Keep compact relocation patterns at call sites (e.g. {{org.antlr}} →
> {{{}groovyjarjarantlr4{}}}) and convert them to Shadow prefix relocations
> inside the task.
> * Post-process the shaded jar: re-add {{{}untouchedFiles{}}}, write
> {{{}INDEX.LIST{}}}, optionally rewrite the OSGi manifest.
> * Update call sites: convention plugins,
> {{{}GroovyLibraryExtension.withGrooid{}}}, binary-compatibility, servlet
> {{{}javaxJar{}}}, jmx / concurrent-java / osgi-test / groovydoc wiring.
> * Document the new task name in {{ARCHITECTURE.md}} and
> {{{}COMPATIBILITY.md{}}}.
> h2. Implementation notes
> ||Before||After||
> |{{JarJarTask}} extends {{DefaultTask}} + Ant jarjar
> {{taskdef}}|{{RepackageJarTask}} extends {{ShadowJar}}|
> |Task name {{jarjar}}|Task name {{repackageJar}}|
> |{{tools}} dep on
> ant-jarjar|{{com.gradleup.shadow:shadow-gradle-plugin:9.6.1}} in
> {{build-logic}}|
> |{{versions.jarjar}}|removed|
> |{{from}} / {{outputFile}} / {{createManifest}} / …|{{inputJar}} /
> {{archiveFile}} / {{generateOsgiManifest}} / {{sourceExcludes}}|
> Overlapping shaded dependency entries (e.g. antlr4-runtime vs
> antlr4-annotations) use {{DuplicatesStrategy.EXCLUDE}} on
> {{RepackageJarTask}} so the shade is first-wins rather than WARN/duplicate.
> h2. Verification
> * {{./gradlew :repackageJar :groovy-json:repackageJar
> :groovy-servlet:javaxJar :grooidJar}} succeeds.
> * Shaded jars still contain {{groovyjarjar}} classes,
> {{{}META-INF/INDEX.LIST{}}}, and OSGi headers as before.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
