asm 4.0 dependency should not be present

[GoogleCodeExporter]

Hi,

Using Kryo in my project, I see that it still has a dependency on asm 4.0 even 
though it appropriately uses a dependency on a shaded version of reflectasm 
(that, I guess, was intended to remove that dependency on asm 4.0...)

----
[INFO] The following files have been resolved:
[INFO]    com.esotericsoftware.kryo:kryo:jar:2.21:compile
[INFO]    com.esotericsoftware.minlog:minlog:jar:1.2:compile
[INFO] com.esotericsoftware.reflectasm:reflectasm:jar:shaded:1.07:compile
[INFO]    org.objenesis:objenesis:jar:1.2:compile
[INFO]    org.ow2.asm:asm:jar:4.0:compile

---

It looks like the published pom of the shaded reflectasm is incorrect (as it 
still contains a dependency to asm 4.0, that has normaly been shaded and 
relocated). 
It should be replaced by a "dependency-reduced" pom (without any dependency to 
asm) 
(http://maven.apache.org/plugins/maven-shade-plugin/shade-mojo.html#createDepend
encyReducedPom)

Kind regards,
Vincent

Original issue reported on code.google.com by vincent...@gmail.com on 25 Jun 2013 at 9:20

[GoogleCodeExporter]

Yes. This could be a problem. 

@Nate: Could you fix it in reflectasm project POM file?
I thin that just adding the following line in the configuration section of the 
maven-shade-plugin should fix the issue:
<createDependencyReducedPom>true</createDependencyReducedPom>

I'll do the same for the kryo pom.xml

Original comment by romixlev on 23 Jul 2013 at 9:31

[GoogleCodeExporter]

In fact, it is not as easy as I thought. When I look into a content of shaded 
jars that we produce currently, I'm a bit puzzled. We relocate our 
dependencies, but for some reason all the dependency JARs are also included 
into our shaded jar. Why does it happen? It does not make too much sense for 
me. Also the pom.xml files do not seem to be affected by the 
createDependencyReducedPom option.

I'm not a big expert in maven-shade-plugin, but may be Martin can help out here?

-Leo

Original comment by romixlev on 23 Jul 2013 at 1:25

[GoogleCodeExporter]

Hi,

I did some research myself and indeed, it is not that simple. :-)
createDependencyReducedPom only works if shadedArtifactAttached is set to false 
(i.e the only pom deployed is the dependency reduced one).

According to me, a same groupId/artifactId has one and only one pom. You can't 
have two poms for same groupId/artifactId even if classifier differs.

The only solution I see is to have a dedicated artifact id (kryo-shaded ?) and 
therefore a dedicated pom, that uses the shade plugin with 
shadedArtifactAttached=false.

Kind regards,
Vincent

Original comment by vincent...@gmail.com on 23 Jul 2013 at 4:09

[GoogleCodeExporter]

Thanks @Vincent for the investigation!
I'm currently on vacation and can have a look at this / fix it next week.

Original comment by martin.grotzke on 23 Jul 2013 at 9:49

[GoogleCodeExporter]

@Martin: This is a small ping! :-) It would be nice if you could look into this 
issue.

Original comment by romixlev on 7 Aug 2013 at 9:38

[GoogleCodeExporter]

Thanx for the ping (got too deep in my stack, sorry), I'll try to look into 
this issue this week.

Original comment by martin.grotzke on 7 Aug 2013 at 8:31

[GoogleCodeExporter]

I see 3 options:

1) Leave things as they are, but improve the documentation to show which 
excludes have to be used with the shaded jar
2) Create a dedicated artifact like "kryo-shaded" with a reduced pom (as 
suggested by Vincent)
3) Only provide the shaded jar/artifact (make the shaded jar the main artifact)

Option 3) is my preference, because it's the simplest solution for users, and 
because the shaded jar only adds ~10k to the normal jar (420k instead of 410k).

What do you think?

Original comment by martin.grotzke on 11 Aug 2013 at 10:44

[GoogleCodeExporter]

We're now using option 3), as release with kryo-2.22.

Additionally I excluded asm from the shaded reflectasm dependency.

Original comment by martin.grotzke on 30 Sep 2013 at 9:42

• Changed state: Fixed
• Added labels: Milestone-2.22

[GoogleCodeExporter]

Option 3 is an excellent option.

Thanks a lot for the fix.

Kr,
Vincent

Original comment by vincent...@gmail.com on 9 Oct 2013 at 11:34

[GoogleCodeExporter]

You're welcome, and thank you for the feedback/confirmation! :-)

Original comment by martin.grotzke on 9 Oct 2013 at 2:09