Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change BOM activation and stop managing dependencies #265

Merged
merged 2 commits into from
Oct 10, 2024
Merged

Change BOM activation and stop managing dependencies #265

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2572615
Change BOM activation and stop managing dependencies
vy Oct 10, 2024
0885ebe
Don't keep `parent` in BOM
vy Oct 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
165 changes: 84 additions & 81 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,15 +206,9 @@
<!-- dependency versions -->
<org.eclipse.jgit.version>7.0.0.202409031743-r</org.eclipse.jgit.version>
<!-- These are annotation with a retention of CLASS. They can be freely upgraded. -->
<bnd.annotation.version>7.0.0</bnd.annotation.version>
<jspecify.version>1.0.0</jspecify.version>
<node.version>21.7.1</node.version>
<npm.version>10.5.0</npm.version>
<osgi.annotation.version>8.1.0</osgi.annotation.version>
<osgi.annotation.bundle.version>2.0.0</osgi.annotation.bundle.version>
<osgi.annotation.versioning.version>1.1.2</osgi.annotation.versioning.version>
<palantir-java-format.version>2.50.0</palantir-java-format.version>
<spotbugs-annotations.version>4.8.6</spotbugs-annotations.version>

<!-- plugin versions -->
<asciidoctor-maven-plugin.version>3.0.0</asciidoctor-maven-plugin.version>
Expand Down Expand Up @@ -254,41 +248,14 @@
<dependencyManagement>
<dependencies>

<dependency>
<groupId>biz.aQute.bnd</groupId>
<artifactId>biz.aQute.bnd.annotation</artifactId>
<version>${bnd.annotation.version}</version>
</dependency>
<!-- ██ ██ █████ ██████ ███ ██ ██ ███ ██ ██████ ██
██ ██ ██ ██ ██ ██ ████ ██ ██ ████ ██ ██ ██
██ █ ██ ███████ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ███ ██
██ ███ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
███ ███ ██ ██ ██ ██ ██ ████ ██ ██ ████ ██████ ██

<dependency>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-annotations</artifactId>
<version>${spotbugs-annotations.version}</version>
</dependency>

<dependency>
<groupId>org.jspecify</groupId>
<artifactId>jspecify</artifactId>
<version>${jspecify.version}</version>
</dependency>

<dependency>
<groupId>org.osgi</groupId>
<artifactId>osgi.annotation</artifactId>
<version>${osgi.annotation.version}</version>
</dependency>

<dependency>
<groupId>org.osgi</groupId>
<artifactId>org.osgi.annotation.bundle</artifactId>
<version>${osgi.annotation.bundle.version}</version>
</dependency>

<dependency>
<groupId>org.osgi</groupId>
<artifactId>org.osgi.annotation.versioning</artifactId>
<version>${osgi.annotation.versioning.version}</version>
</dependency>
Do not add entries to this `dependencyManagement > dependencies` block!
Otherwise they leak into BOMs: https://github.com/apache/logging-log4j2/issues/3066 -->

</dependencies>
</dependencyManagement>
Expand Down Expand Up @@ -442,47 +409,6 @@
<phase>clean</phase>
</execution>

<!-- BOMs should ideally _only_ contain dependencies for modules of the project.
No invasive properties or plugin/dependency management – either from the BOM itself or its parent.
The following `flatten-maven-plugin` exactly performs that trimming operation. -->
<execution>
<id>flatten-bom</id>
<goals>
<goal>flatten</goal>
</goals>
<!-- BOM flattening is disabled by default!
This execution must be manually enabled by the consumer. -->
<phase>none</phase>
<configuration>
<flattenMode>bom</flattenMode>
<!-- POM `ElementHandling` is pretty cryptic: https://www.mojohaus.org/flatten-maven-plugin/apidocs/org/codehaus/mojo/flatten/ElementHandling.html
Trial-and-error has shown that we should use either `remove` or `interpolate`.
`remove` simply removes the element.
`interpolate` takes the element from the original POM with variables interpolated.
Avoid using `resolve`, which uses the effective POM where inherited changes from the parent are also incorporated. -->
<pomElements>
<build>remove</build>
<properties>remove</properties>
<repositories>remove</repositories>
<distributionManagement>remove</distributionManagement>
<dependencyManagement>interpolate</dependencyManagement>
<!-- Keep the `parent`!
Otherwise, this causes build failures for artifacts whose dependencies need to be resolved at runtime.
Consider the following problem experienced in `log4j-transform-maven-plugin`:

1. `log4j-transform-parent` depends on `log4j-transform-bom`
2. `log4j-transform-bom` depends on `logging-parent`
3. `logging-parent` contains `dependencyManagement`, etc. that are used by `log4j-transform-maven-plugin`
4. Dependencies of `log4j-transform-maven-plugin` et al. is resolved *at runtime*
5. Though at runtime, the deployed `log4j-transform-bom` is used, which is flattened and hence doesn't have a parent!
6. Hence, at runtime, all `logging-parent` logic is lost

To avoid this, parents should better be kept while flattening BOMs. -->
<parent>keep</parent>
</pomElements>
</configuration>
</execution>

</executions>
</plugin>

Expand Down Expand Up @@ -1018,6 +944,83 @@

<profiles>

<!-- `bom` profile to generate BOMs -->
<profile>

<id>bom</id>

<!-- Profile gets activated using a file instead of, say, a property defined by the child `pom.xml`.
Since a Maven property lookup requires model interpolation and that happens after the profile activation phase.
See: https://maven.apache.org/ref/3.9.6/maven-model-builder -->
<activation>
<file>
<exists>.logging-parent-bom-activator</exists>
</file>
</activation>

<build>
<plugins>

<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>flatten-maven-plugin</artifactId>
<executions>

<!-- Explicitly specifying the `flatten-revision` execution to set its order in execution -->
<execution>
<id>flatten-revision</id>
</execution>

<!-- BOMs should ideally _only_ contain dependencies for modules of the project.
No invasive properties or plugin/dependency management – either from the BOM itself or its parent.
The following execution exactly performs that trimming operation. -->
<execution>
<id>flatten-bom</id>
<goals>
<goal>flatten</goal>
</goals>
<phase>process-resources</phase>
<configuration>
<flattenMode>bom</flattenMode>
<!-- POM `ElementHandling` is pretty cryptic: https://www.mojohaus.org/flatten-maven-plugin/apidocs/org/codehaus/mojo/flatten/ElementHandling.html
Trial-and-error has shown that we should use either `remove` or `interpolate`.
`remove` simply removes the element.
`interpolate` takes the element from the original POM with variables interpolated.
Avoid using `resolve`, which uses the effective POM where inherited changes from the parent are also incorporated. -->
<pomElements>
<build>remove</build>
<dependencyManagement>interpolate</dependencyManagement>
<distributionManagement>remove</distributionManagement>
<profiles>remove</profiles>
<properties>remove</properties>
<repositories>remove</repositories>
<!-- Keep the `parent`!
Otherwise, this causes build failures for artifacts whose dependencies need to be resolved at runtime.
Consider the following problem experienced in `log4j-changelog-maven-plugin`:

1. `log4j-changelog-maven-plugin` depends on `log4j-changelog`
2. `log4j-changelog` inherits from `log4j-tools-parent`
3. `log4j-tools-parent` inherits from `log4j-tools-bom`
4. `log4j-tools-bom` inherits from `logging-parent`
5. `logging-parent` contains `dependencyManagement`, etc. entries that are used by `log4j-changelog-maven-plugin`
6. Dependencies of `log4j-changelog-maven-plugin` et al. is resolved *at runtime*
7. Though at runtime, the deployed `log4j-tools-bom` is used, which is flattened and hence doesn't have a parent!
8. Hence, at runtime, `log4j-transform-maven-plugin` execution fails due to missing logic that should have been inherited from `logging-parent`

To avoid this, parents should better be kept while flattening BOMs. -->
<parent>keep</parent>
vy marked this conversation as resolved.
Show resolved Hide resolved
</pomElements>
</configuration>
</execution>

</executions>
</plugin>

</plugins>
</build>

</profile>

<!-- `changelog-validate` profile to validate changelog XMLs -->
<profile>

Expand Down
6 changes: 3 additions & 3 deletions ...github_spotbugs_spotbugs_maven_plugin.xml → src/changelog/.11.x.x/bom_activation.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="https://logging.apache.org/xml/ns"
xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
type="updated">
<issue id="248" link="https://github.com/apache/logging-parent/pull/248"/>
<description format="asciidoc">Update `com.github.spotbugs:spotbugs-maven-plugin` to version `4.8.6.4`</description>
type="changed">
<issue id="265" link="https://github.com/apache/logging-parent/pull/265"/>
<description format="asciidoc">Activate `flatten-bom` execution of `flatten-maven-plugin` using a `.logging-parent-bom-activator` file</description>
</entry>
15 changes: 15 additions & 0 deletions src/changelog/.11.x.x/bom_deps.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
<?xml version="1.0" encoding="UTF-8"?>
<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="https://logging.apache.org/xml/ns"
xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
type="removed">
<issue id="265" link="https://github.com/apache/logging-parent/pull/265"/>
<issue id="apache/logging-log4j2#3066" link="https://github.com/apache/logging-log4j2/issues/3066"/>
<description format="asciidoc">Remove following managed dependencies to avoid polluting BOMs:
** `biz.aQute.bnd:biz.aQute.bnd.annotation`
** `com.github.spotbugs:spotbugs-annotations`
** `org.jspecify:jspecify`
** `org.osgi:osgi.annotation`
** `org.osgi:org.osgi.annotation.bundle`
** `org.osgi:org.osgi.annotation.versioning`</description>
</entry>
Loading