[JIRA] (IDP-1955) Add attachClasses to the maven-war-plugin in idp-parent

Tue Jun 28 01:13:50 UTC 2022

Dan McLaughlin ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A3a8d6dab-64f5-4a62-a23e-1603099d1796 ) *commented* on IDP-1955 ( https://shibboleth.atlassian.net/browse/IDP-1955?atlOrigin=eyJpIjoiMjMwNjI4Y2E1Mzk2NDJjNzkzMWM2ODBhNDQ0MmEyMjMiLCJwIjoiaiJ9 )

Re: Add attachClasses to the maven-war-plugin in idp-parent ( https://shibboleth.atlassian.net/browse/IDP-1955?atlOrigin=eyJpIjoiMjMwNjI4Y2E1Mzk2NDJjNzkzMWM2ODBhNDQ0MmEyMjMiLCJwIjoiaiJ9 )

Tom Zeller ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A0fa99aa9-d698-454c-a274-7a41bee6cef5 ) The idp-war-distribution works until you need to override a dependency. That’s why we are asking that you add the attachClasses to the Maven war plugin. All that option does is add a jar as an additional build artifact to any of the war modules, which is going to be helpful for any project that wants to customize the war using Maven and be able to use dependency management to override any dependency versions when necessary.

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) I would ask that you PLEASE reconsider this. It’s very important to have this change because without it we are restricted to only being able to use Maven WAR Overlays ( https://maven.apache.org/plugins/maven-war-plugin/overlays.html ). WAR Overlays are fine until you have dependency convergence issues, or you need to patch a third-party dependency for any reason, then WAR Overlays become useless because you have to resort to hacking at the dependencies using various exclude/includes, or in most cases, the only way is to resort to extracting the war and using multiple plugins to try to delete and add dependencies, which is a nightmare to manage. The problem is caused by the fact that WAR’s aren’t tied into Maven dependency management. So any dependency versions you have defined in dependencyManagement are ignored with WAR Overlays, when a WAR is built without the attachClasses option your only option is WAR Overlays without dependency management. To do something as simple as update the Spring framework to the next patch release to pick up a security fix we would have to resort to hacking at the war dependencies using various excludes and then extract the jars we need, which can become a mess very quick and complicated to maintain.

See the following URL is where the attachClasses option in the Maven WAR plugin is discussed. https://maven.apache.org/plugins/maven-war-plugin/faq.html#attached

This change is very low risk, even for a patch release, and it doesn’t affect anyone using the war. All the attachClasses does is add a jar to the build artifacts so that downstream projects customizing the war using Maven can use Maven’s dependency management to override dependencies when necessary. For example, if there is a security issue in a third-party dependency used by the IDP that we need to upgrade prior to an IDP patch being released we can easily use Maven’s dependency management to specify the version of the dependency with the fix and Maven will make sure that the newer version of the dependency is used when packaging the final war with our customizations.

Without this change, we either have to resort to manually building the IDP war and defining all the dependencies for the IDP so that dependency management will work, this is a huge pain because every time a new IDP is released I have to make sure all the dependencies are updated in our pom. This option I’m not going to do, it’s a huge headache to maintain. My other option is to maintain our own custom version of idp-parent with attachClasses added, this also means I have to build and deploy the build artifacts to our internal repository so we can use the idp-war-distribution and idp-war that have the jar attached. With the jar we can then use maven dependency management to pull in all the dependencies for the idp war, as well as do any version overrides we need.

Please reconsider, this is very low risk, and the only thing anyone will notice is that there will be both a war and a jar included in the build artifacts. If you have the need to override dependencies, then instead of using the war, you would use the jars instead. I’ve attached an example pom.xml showing how we would use the idp-war and idp-war-distribution classes to pull in the dependencies and override spring and unbound-ldapsdk.

( https://shibboleth.atlassian.net/browse/IDP-1955#add-comment?atlOrigin=eyJpIjoiMjMwNjI4Y2E1Mzk2NDJjNzkzMWM2ODBhNDQ0MmEyMjMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1955#add-comment?atlOrigin=eyJpIjoiMjMwNjI4Y2E1Mzk2NDJjNzkzMWM2ODBhNDQ0MmEyMjMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100201- sha1:66eda1f )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220628/f0e6bc91/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-f0862754-a7ad-4f0b-a02b-50872ce6d309
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220628/f0e6bc91/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-2e37210d-0b17-4277-a470-63ea3df1c8f6
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220628/f0e6bc91/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-3a547924-1424-4292-980b-29f373b3f437
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220628/f0e6bc91/attachment-0005.png>