Re: Maven Assembly Plugin resolves extensions of dependencies -- is this intentional?

[Tamás Cservenák]

Thanks Eric for confirming this. For a moment i thought am loosing my mind
:)

Thanks
T


On Thu, Mar 11, 2021, 22:07 Eric Lilja  wrote:

> For what it's worth, I noticed the same thing a while back when setting up
> an offline system for a particular project at work. I was stunned at some
> of the artifacts being downloaded when invoking certain plugins. Thanks for
> looking into this and trying to improve the situation.
>
> - Eric L
>
> On Thu, Mar 11, 2021 at 4:19 PM Tamás Cservenák 
> wrote:
>
> > Howdy,
> >
> > just a quick question, I thought someone may enlighten me...
> >
> > Noticed, that Maven _resolves_ and _creates extension realms_ for things
> I
> > did not opt to at all. Typical example is nexus-staging-maven-plugin,
> that
> > maven 3.6.3 resolves at one moment in my build, despite not using it.
> >
> > So, what and why is maven-assembly-plugin doing this?
> >
> > ===
> >
> > Here is an example project:
> > https://github.com/cstamas/mvn-md-bug
> >
> > Just add new dependency in POM, jackson for example that uses extensions
> in
> > it's own build (copy paste into POM):
> >
> > 
> >   com.fasterxml.jackson.core
> >   jackson-databind
> >   2.12.2
> > 
> >
> > use vanilla maven 3.6.3 and run `mvn clean install -X`
> >
> > You will notice:
> > - plugin lists 3 dependencies of project (OK), 1 will be filtered out
> > (junit, test scope) OK
> > - and then bunch of extensions are being resolved and created and added
> to
> > maven (gitexe, gitsite, felix bundle plugin, and so on, up to
> > nexus-staging-maven-plugin).
> >
> > Here is a "plain" console output of the build, that creates assembly of 2
> > JARs:
> > https://gist.github.com/cstamas/559b8083764ee7a9c9807551b73308f3
> >
> > Scroll to line 834 (where massembly begins) and just watch what it
> > downloads...
> >
> > To me, it seems like assembly is doing much-much more than it should? Or
> am
> > unaware why dependency build extensions need to be loaded?
> >
> > Note: the assembly ends up OK, it has 2 jar in it.
> >
> > Thanks
> > T
> >
>

Re: Maven Assembly Plugin resolves extensions of dependencies -- is this intentional?

[Eric Lilja]

For what it's worth, I noticed the same thing a while back when setting up
an offline system for a particular project at work. I was stunned at some
of the artifacts being downloaded when invoking certain plugins. Thanks for
looking into this and trying to improve the situation.

- Eric L

On Thu, Mar 11, 2021 at 4:19 PM Tamás Cservenák  wrote:

> Howdy,
>
> just a quick question, I thought someone may enlighten me...
>
> Noticed, that Maven _resolves_ and _creates extension realms_ for things I
> did not opt to at all. Typical example is nexus-staging-maven-plugin, that
> maven 3.6.3 resolves at one moment in my build, despite not using it.
>
> So, what and why is maven-assembly-plugin doing this?
>
> ===
>
> Here is an example project:
> https://github.com/cstamas/mvn-md-bug
>
> Just add new dependency in POM, jackson for example that uses extensions in
> it's own build (copy paste into POM):
>
> 
>   com.fasterxml.jackson.core
>   jackson-databind
>   2.12.2
> 
>
> use vanilla maven 3.6.3 and run `mvn clean install -X`
>
> You will notice:
> - plugin lists 3 dependencies of project (OK), 1 will be filtered out
> (junit, test scope) OK
> - and then bunch of extensions are being resolved and created and added to
> maven (gitexe, gitsite, felix bundle plugin, and so on, up to
> nexus-staging-maven-plugin).
>
> Here is a "plain" console output of the build, that creates assembly of 2
> JARs:
> https://gist.github.com/cstamas/559b8083764ee7a9c9807551b73308f3
>
> Scroll to line 834 (where massembly begins) and just watch what it
> downloads...
>
> To me, it seems like assembly is doing much-much more than it should? Or am
> unaware why dependency build extensions need to be loaded?
>
> Note: the assembly ends up OK, it has 2 jar in it.
>
> Thanks
> T
>

Maven Assembly Plugin resolves extensions of dependencies -- is this intentional?

[Tamás Cservenák]

Howdy,

just a quick question, I thought someone may enlighten me...

Noticed, that Maven _resolves_ and _creates extension realms_ for things I
did not opt to at all. Typical example is nexus-staging-maven-plugin, that
maven 3.6.3 resolves at one moment in my build, despite not using it.

So, what and why is maven-assembly-plugin doing this?

===

Here is an example project:
https://github.com/cstamas/mvn-md-bug

Just add new dependency in POM, jackson for example that uses extensions in
it's own build (copy paste into POM):


  com.fasterxml.jackson.core
  jackson-databind
  2.12.2


use vanilla maven 3.6.3 and run `mvn clean install -X`

You will notice:
- plugin lists 3 dependencies of project (OK), 1 will be filtered out
(junit, test scope) OK
- and then bunch of extensions are being resolved and created and added to
maven (gitexe, gitsite, felix bundle plugin, and so on, up to
nexus-staging-maven-plugin).

Here is a "plain" console output of the build, that creates assembly of 2
JARs:
https://gist.github.com/cstamas/559b8083764ee7a9c9807551b73308f3

Scroll to line 834 (where massembly begins) and just watch what it
downloads...

To me, it seems like assembly is doing much-much more than it should? Or am
unaware why dependency build extensions need to be loaded?

Note: the assembly ends up OK, it has 2 jar in it.

Thanks
T

Re: testing pgpverify-maven-plugin

[Andreas Sewe]

Hi,

> I just tested pgpverify-maven-plugin on maven-artifact-plugin [1].
> I was successful, really nice.

I second that. Highly useful plugin and well-documented, too, which
unfortunately isn't always the case.

I have a few suggestions for improvement, though, which I have added to
the GitHub issue tracker [1]. Hope that helps.

Best wishes,

Andreas Sewe

[1] 



signature.asc
Description: OpenPGP digital signature