<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 5/15/17 8:30 AM, Etienne
Dysli-Metref wrote:<br>
</div>
<blockquote type="cite"
cite="mid:fa968e15-243e-9c40-2a73-d2f12ceddb61@switch.ch">
<pre wrap="">
</pre>
<pre wrap="">
Spring solves this by providing a "bill of materials" POM [1] meant to
be included in <dependencyManagement>. It ensures that all Spring
Framework artifacts are at the same version. Spring Boot goes even
further and manages its transitive dependencies in a BOM to provide a
consistent, tested set of libraries.
</pre>
</blockquote>
<br>
So if I'm understanding correctly, this is essentially introducing a
layer of indirection, by 1) creating a POM-only project that
contains a dependencyManagement section 2) including that dependency
in your own POM's dependencyManagement section. So sort of
declaring the dependencies by reference rather than by value.<br>
<br>
I think I like it. IMHO I think we should look into this in more
detail to understand the nuances of how it works and confirm it does
what we want. So yes, seems very interesting.<br>
<br>
In a way, this is kind of like multiple inheritance for the POM -
since you can presumably include multiple BOMs - but just for the
dependencyManagement section. So I guess it's more like a mix-in.<br>
<br>
<blockquote type="cite"
cite="mid:fa968e15-243e-9c40-2a73-d2f12ceddb61@switch.ch">
<pre wrap="">
I already suggested using the Spring BOM in your java-parent project to
simplify its POM [3].</pre>
</blockquote>
<br>
I remember seeing that (nearly 2 years ago!), and apologize for not
looking at it more closely. (Whenever I see BOM I think Unicode
byte-order-mark...)<br>
<br>
<br>
<blockquote type="cite"
cite="mid:fa968e15-243e-9c40-2a73-d2f12ceddb61@switch.ch">
<pre wrap=""> Come to think of it, also providing a BOM for the
IdP would be really convenient for extension developers.</pre>
</blockquote>
<br>
Yes, developing an idp-bom for IdP extension devs seems useful. And
for the OP's original case in this thread, seems like an
opensaml-bom would be in order.<br>
<br>
Can BOM POMs be layered like regular POMs (that is, inherit from
other BOM POMs)? Just wondering about avoiding duplicating common
versions all over the place. If so, seems like we might factor the
java-parent-v3 dependencyManagement out to a parent-bom, from which
we then inherit for the opensaml-bom, and idp-bom. So sort of a
parallel inheritance hierarchy as currently exists for the regular
POMs. Or maybe it's slightly different, depending on how it all
works, but you get the basic idea of why I'm asking.<br>
<br>
<br>
<br>
</body>
</html>