[java-mvn-enforcer] branch main updated: JMVN-15 Allow finer granularity of control on what is a fatal dependency check.
Rod Widdowson
rdw at steadingsoftware.com
Wed Dec 29 15:23:14 UTC 2021
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch main
in repository java-mvn-enforcer.
View the commit online:
http://git.shibboleth.net/view/?p=java-mvn-enforcer.git;a=commit;h=41acea0a3ff4ce33b3fe2c2e3757621ac716f738
The following commit(s) were added to refs/heads/main by this push:
new 41acea0 JMVN-15 Allow finer granularity of control on what is a fatal dependency check.
41acea0 is described below
commit 41acea0a3ff4ce33b3fe2c2e3757621ac716f738
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Wed Dec 29 13:50:10 2021 +0000
JMVN-15 Allow finer granularity of control on what is a fatal dependency check.
https://shibboleth.atlassian.net/browse/JMVN-15
Add <compileRuntimeArtifactFatal/>
<distVersionMismatchFatal/>
<pomVersionMismatchFatal/>
<multipleJarVersionsFatal/>
---
.../mvn/enforcer/impl/DependencyChecker.java | 51 +++++++++++++++-------
.../shibboleth/mvn/enforcer/impl/JarEnforcer.java | 15 ++++++-
2 files changed, 48 insertions(+), 18 deletions(-)
diff --git a/src/main/java/net/shibboleth/mvn/enforcer/impl/DependencyChecker.java b/src/main/java/net/shibboleth/mvn/enforcer/impl/DependencyChecker.java
index 4527243..e84d9f1 100644
--- a/src/main/java/net/shibboleth/mvn/enforcer/impl/DependencyChecker.java
+++ b/src/main/java/net/shibboleth/mvn/enforcer/impl/DependencyChecker.java
@@ -93,17 +93,40 @@ public class DependencyChecker {
/** Number of artefacts where we couldn't find lookup its dependencies. */
private int analysisFails;
+ /** Duplicates in versions between the POM and the distribution. */
+ private final boolean distVersionMismatchFatal;
+
+ /** Duplicates in versions between the POMs. */
+ private final boolean pomVersionMismatchFatal;
+
+ /** Duplicate jars (same name, different versions. */
+ private final boolean multipleJarVersionsFatal;
+
+ /** Artifact declared as runtime and as compile. */
+ private final boolean compileRuntimeArtifactFatal;
+
/** Constructor.
* @param project The project
* @param writer Where to write our report
+ * @param isCompileRuntimeArtifactFatal fail if artifact appears in both places.
+ * @param isDistVersionMismatchFatal fail if artifact version doesn't match jar
+ * @param isPomVersionMismatchFatal fail if artifact appears in both places.
+ * @param isMultipleJarVersionsFatal fail if artifact appears with multiple versions in the poms.
+
*/
- public DependencyChecker( @Nonnull final ProjectPomContext project, @Nonnull final PrintWriter writer) {
+ public DependencyChecker( @Nonnull final ProjectPomContext project, @Nonnull final PrintWriter writer,
+ final boolean isCompileRuntimeArtifactFatal, final boolean isDistVersionMismatchFatal,
+ final boolean isPomVersionMismatchFatal, final boolean isMultipleJarVersionsFatal) {
projectContext = Constraint.isNotNull(project, "Project context must not be null");
report = Constraint.isNotNull(writer, "Writer must not be null");
if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
Security.addProvider(new BouncyCastleProvider());
}
+ compileRuntimeArtifactFatal = isCompileRuntimeArtifactFatal;
+ distVersionMismatchFatal = isDistVersionMismatchFatal;
+ pomVersionMismatchFatal = isPomVersionMismatchFatal;
+ multipleJarVersionsFatal = isMultipleJarVersionsFatal;
}
/** The Body of the Dependency test. Are all the files what we expected? Who produced what?
@@ -117,6 +140,7 @@ public class DependencyChecker {
if (!enumerateJars(archive)) {
return true;
}
+ boolean failed = false;
report.format("Dependencies found:\n");
@@ -129,14 +153,17 @@ public class DependencyChecker {
if (runtimeAndCompileArtifacts != 0) {
report.format("\n%d Duplicates (Runtime & Compile) \n", runtimeAndCompileArtifacts);
log.info("{} Runtime/compile duplicates", runtimeAndCompileArtifacts);
+ failed |= compileRuntimeArtifactFatal;
}
if (duplicateJars != 0) {
report.format("\n%d Artifacts with multiple versions or locations\n", duplicateJars);
log.error("{} similarly named jars", duplicateJars);
+ failed |= multipleJarVersionsFatal;
}
if (dupEntries != 0) {
- report.format("\n%d Artifacts defined differently inside the project\n", dupEntries);
- log.error("{} Artifacts defined differently inside the project", dupEntries);
+ report.format("\n%d Artifacts defined differently inside the project (between poms)\n", dupEntries);
+ log.error("{} Artifacts defined differently inside the project (between poms)", dupEntries);
+ failed |= pomVersionMismatchFatal;
}
report.format("\n%d dependencies, %d found, %d declared"+
@@ -152,21 +179,13 @@ public class DependencyChecker {
report.format("%d Wrong versions(s)\n\n", versionMismatch);
if (analysisFails > 0) {
log.error("{} failed analysis", analysisFails);
+ failed = true;
}
if (versionMismatch > 0) {
- log.error("{} mismatched versions", versionMismatch);
- }
- if (versionMismatch > 0) {
- log.error("{} ", versionMismatch);
- }
- if (!parentPom.getDuplicates().isEmpty()) {
- log.error("Duplicate dependencies (see report)");
+ log.error("{} Mismatched versions (between the POM and the distribution)", versionMismatch);
+ failed |= distVersionMismatchFatal;
}
- return analysisFails == 0 &&
- versionMismatch == 0 &&
- duplicateJars == 0 &&
- dupEntries == 0 &&
- parentPom.getDuplicates().isEmpty();
+ return !failed;
}
//Checkstyle: CyclomaticComplexity ON
@@ -262,7 +281,7 @@ public class DependencyChecker {
final ParsedPom parentPom = projectContext.getParentPom();
int dupEntries = 0;
if (!parentPom.getDuplicates().isEmpty()) {
- report.format("Duplicates found parsing the poms\n");
+ report.format("Duplicates (different versions) found parsing the poms\n");
for (final Pair<PomArtifact,PomArtifact> poms : parentPom.getDuplicates()) {
final PomArtifact f = poms.getFirst();
final PomArtifact s = poms.getSecond();
diff --git a/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java b/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
index aaa6e9b..b6d2bf0 100644
--- a/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
+++ b/src/main/java/net/shibboleth/mvn/enforcer/impl/JarEnforcer.java
@@ -96,6 +96,15 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
private String sigCheckReportPath;
/** Fully Qualified Path of Dependency Report.*/
private String depCheckReportPath;
+ /** Artifact declared as runtime and as compile. */
+ private boolean compileRuntimeArtifactFatal = true;
+ /** Duplicates in versions between the POM and the distribution. */
+ private boolean distVersionMismatchFatal = true;
+ /** Duplicates in versions between the POMs. */
+ private boolean pomVersionMismatchFatal = true;
+ /** Duplicate jars (same name, different versions. */
+ private boolean multipleJarVersionsFatal = true;
+
/** The list of things which get added to real versions. */
private String versionExtensions = "-SNAPSHOT -GA -jre -empty-to-avoid-conflict-with-guava";
@@ -339,14 +348,16 @@ public class JarEnforcer implements EnforcerRule, MavenLoader{
for (final Path tgzPath: tgzPaths) {
report.format("Scanning %s \n\n", tgzPath);
try (final InputStream inStream = new BufferedInputStream(new FileInputStream(tgzPath.toFile()))) {
- final DependencyChecker checker = new DependencyChecker(pomContext, report);
+ final DependencyChecker checker = new DependencyChecker(pomContext, report, compileRuntimeArtifactFatal,
+ distVersionMismatchFatal, pomVersionMismatchFatal, multipleJarVersionsFatal);
depdendencyResult &= checker.checkDependencies(new TarArchiveInputStream(new GzipCompressorInputStream(inStream)), listJarSources);
}
}
for (final Path zipPath: zipPaths) {
report.format("Scanning %s \n\n", zipPath);
try (final InputStream inStream = new BufferedInputStream(new FileInputStream(zipPath.toFile()))) {
- final DependencyChecker checker = new DependencyChecker(pomContext, report);
+ final DependencyChecker checker = new DependencyChecker(pomContext, report, compileRuntimeArtifactFatal,
+ distVersionMismatchFatal, pomVersionMismatchFatal, multipleJarVersionsFatal);
depdendencyResult &= checker.checkDependencies(new ZipArchiveInputStream(inStream), listJarSources);
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list