[MASSEMBLY-675] Maven Assembly packaging wildcard-excluded dependencies

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.4
• Fix Version/s: 3.1.1
• Environment: Apache Maven 3.1.1; Java version: 1.7.0_45, vendor: Oracle Corporation; OS name: "mac os x", version: "10.8.4", arch: "x86_64", family: "mac"
• Assignee: Guillaume Boué
• Reporter: Frank Wilson
• Created: 02/Dec/13 11:40
• Updated: 22/Dec/18 12:52
• Resolved: 20/Feb/18 17:00

Description

Version 2.4 ignores wildcard exclusions in POM dependencies

Example (perhaps contrived - but easy to setup):

When a pom declares a dependency such as closure-compiler and for some reason we do not want to pull its dependencies in we could declare this in our POM, without having to know what those dependencies are:

<dependencies>
 <dependency>
 <groupId>com.google.javascript</groupId>
 <artifactId>closure-compiler</artifactId>
 <version>v20131014</version>
 <exclusions>
 <exclusion>
 <artifactId>*</artifactId>
 <groupId>*</groupId>
 </exclusion>
 </exclusions>
 </dependency>
 </dependencies>

This is a valid use of the exclusion feature as per Maven Confluence, MNG-3832. False warning about wildcards were fixed in Git about 10 days ago
Here is the assembly descriptor:

<assembly>
 <id>bin</id>
 <formats>
 <format>dir</format>
 </formats>
 <includeBaseDirectory>false</includeBaseDirectory>
 <dependencySets>
 <dependencySet/>
 </dependencySets>
 </assembly>

We expect to only find the current project artifact and the closure-compiler JAR in our directory assembly. However the assembly plugin ignores our POM directive and includes the closure-compilers dependencies anyway!

Steps to reproduce are:

$ unzip massembly-675.zip
 $ cd massembly-675
 $ mvn clean install
 $ ls target/massembly-675-1-bin
 args4j-2.0.16.jar json-20090211.jar protobuf-java-2.4.1.jar
 closure-compiler-v20131014.jar jsr305-1.3.9.jar
 guava-15.0.jar massembly-675-1.jar

Notice that the excluded jars are included in the assembly

I would expect to only see the following JARs.

• closure-compiler-v20131014.jar
• massembly-675-1.jar

Issue Links

• is duplicated by: MASSEMBLY-861 exclusion * also packaged
• relates to: MASSEMBLY-762 Assembly plugin doesn't exclude transitive dependencies when excluded by wildcards in dependencies section
• relates to: MASSEMBLY-799 Exclusion on wildcard, then the assembly would still package to include the excluded libraries
• links to: GitHub Pull Request #2