Re: Problem with handling of dependencies in POMs

[Matthew Vernon <matthew@debian.org>]

Hi again,

> Executive summary: mh_make should be trying to find
> commons-httpclient:commons-httpclient:jar:3.x, but is actually failing
> to find commons-httpclient:commons-httpclient:jar:debian

This was a bore to track down, but I got there. The answer is
two-fold:

i) maven lies about its dependency paths
ii) ant-contrib's POM depends on a non-existent version of
commons-httpclient 

I think both of these are bugs
 
> My libopenws-java package[0] includes
> /usr/share/maven-repo/org/opensaml/openws/debian/openws-debian.pom
> 
> which has (amongst other things):
>         <properties>
> 
> <debian.commons-httpclient.commons-httpclient.originalVersion>3.1</debian.commons-httpclient.commons-httpclient.originalVersion>
>         </properties>
> and
>                 <dependency>
>                         <groupId>commons-httpclient</groupId>
>                         <artifactId>commons-httpclient</artifactId>
>                         <version>3.x</version>
>                         <exclusions>
>                                 <exclusion>
>                                         <groupId>commons-logging</groupId>
> 
> <artifactId>commons-logging</artifactId>
>                                 </exclusion>
>                         </exclusions>
>                 </dependency>

This was all correct. However, ant-contrib's POM depends on version
"debian" of commons-httpclient, which is wrong.
 
> 2) commons-httpclient:commons-httpclient:jar:debian
> 
> [snip suggestion of downloading & building it]
> 
>   Path to dependency:
>         1) edu.internet2.middleware:shibboleth-common:jar:1.4.1-SNAPSHOT
>         2) org.opensaml:opensaml:jar:debian
>         3) org.opensaml:openws:jar:debian
>         4) commons-httpclient:commons-httpclient:jar:debian

Here, maven is lying. Whilst org.opensaml:openws does depend on
commons-httpclient:commons-httpclient, it depends on version 3.x. In
fact it is ant-common that depends on the broken version.

If I fix the version in ant-contrib's POM, then maven no longer
complains about being unable to find
commons-httpclient:commons-httpclient:jar:debian

Regards,

Matthew

-- 
"At least you know where you are with Microsoft."
"True. I just wish I'd brought a paddle."
http://www.debian.org