Merging transitive jar-dependencies of several gem-dependencies without using lock_jar-bundler integration

[Hachmaninow]

Using the bundler integration lock_jar very helpfully scans all gems in the current bundle to find Jarfiles in order to merge transitive dependencies. Because of several issues we decided to abandon the bundler integration of lock_jar. Unfortunately there does not seem to be a way to specify gem-dependencies in the Jarfile to achieve the same effect as when using the bundler integration.

Are we missing something?

[mguymon]

Right now, a Jarfile only deals with jars. There is no way to chain together Jarfiles to create a merged lock file.

If you have tinkered with the Bundler support, you know that it is experimental at best. I am not even sure if it works with the latest Bundler. Maybe the Bundler support could be retool, instead of hijacking Bundler have the Jarfile point at the Gemfile.lock. When the Jarfile is locked, it would scan the gems from the Gemfile.lock for existing lock files and merge them in.

[Hachmaninow]

Hi,

I think this is a very good and sensible idea! That way Java-dependencies of Ruby-Gems could propagate as transitive dependencies into other Ruby projects.

We would highly appreciate such an improvement as currently the workflow involves temporarily enabling the bundler-integration by uncommenting require 'lock_jar/bundler' in the Gemfile to run bundle install.

Please give us a note, if we can help with anything to make this possible.

Thank you. Björn

[mguymon]

Most of the code already exists in various states, so it should not be hard to tie it all together. I can whip something up for you in the next few days.

[mguymon]

Ok, I have a rough draft working as a separate gem, but I have not released anything yet. If you could give it a whirl directly from the repo and see if it helps:

gem 'lock_jar_bundler', git: 'https://github.com/mguymon/lock_jar_bundler'

This adds support for a new dsl command, bundler.

bundler(*groups) - Enables bundler support when locking this Jarfile. The Bundled gems 
will be scanned for a Jarfile and merged in. Takes an optional parameter of Bundler groups 
to load, defaults to :default.

Example Jarfile:

bundler
jar "com.tobedevoured.command:core:0.3.2"

Now when LockJar.lock is called, the produced lockfile will include all Jarfiles in Bundled gems. The lockfile will list what Jarfiles have been merged via:

merged:
- "/absolute/path/dummy_gem/Jarfile"

The plan is to use a gem notation (something like gem:dummy_gem:Jarfile ) for merged, instead of an absolute path. First though, want to make sure it will integrate correctly with Bundler

[Hachmaninow]

Thank you very much. I was in holidays the last week, but will try it out the following days.

[Hachmaninow]

I have tried the new bundler integration and overall it seems to work. This is great! Thank you very much!

Nevertheless some issues occurred: 1) It seems as if pom-instructions found in merged Jarfiles are processed in the current directory (resulting in an error if no pom-file exists or the processing of a wrong pom.xml). I was able to fix this by calculating a full path in the Dsl class. 2) If there are conflicting versions of a specific jar dependency found in several merged Jarfiles, there seems to be no resolution mechanism. For us it seems sufficient to use the highest versioned of all jars. 3) The call to bundler from the Jarfile needs a group explicitly specified as parameter. The default value ([:default] as described) does not work.

Kind regards.

[mguymon]

:fireworks: I am glad it helps!

Yup, those would be bugs.

1) Instructions need to be gem relative when they are merged in 2) This will be a big issue with merging Jarfiles, what to do if there is a conflict that Aether cannot resolve. Probably the best route is allow the parent Jarfile to apply overrides to the Jarfiles merged in, e.g. always use X, ignore Y. 3) :bug:

[mguymon]

I ended up keeping support directly in LockJar - https://github.com/mguymon/lock_jar/blob/master/README.md#bundler-integration