[MENFORCER-300] Enforcer somewhat is too sensitive

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 3.0.0-M1
• Component/s: Plugin
• Assignee: Unassigned
• Reporter: Seweryn Habdank-Wojewodzki
• Created: 29/Mar/18 14:55
• Updated: 05/Sep/19 14:37
• Resolved: 24/Feb/19 23:40

Description

I am building library with maven settings:

    <maven.compiler.source>1.7</maven.compiler.source>
    <maven.compiler.target>1.7</maven.compiler.target>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>3.7.0</version>
        <configuration>
          <executable>${jvm.path}/bin/javac</executable>
          <source>1.7</source>
          <target>1.7</target>
        </configuration>
      </plugin>

And our customer require that we provide JDK 1.7 compatible SW.

Thanks to the help How to confiugure maven-enforcer-plugin to exclude some rule in test scope? I had setup:

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <version>3.0.0-M1</version>
        <executions>
          <execution>
            <id>enforce-bytecode-version</id>
            <goals>
              <goal>enforce</goal>
            </goals>
            <configuration>
              <rules>
                <enforceBytecodeVersion>
                  <maxJdkVersion>1.7</maxJdkVersion>
                  <ignoredScopes>
                    <ignoreScope>test</ignoreScope>
                  </ignoredScopes>
                </enforceBytecodeVersion>
              </rules>
              <fail>true</fail>
            </configuration>
          </execution>
        </executions>
        <dependencies>
          <dependency>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>extra-enforcer-rules</artifactId>
            <version>1.0-beta-7</version>
          </dependency>
        </dependencies>
      </plugin>

Compiler plugin settings guarantee that *our* code is 1.7, but enforce plugin proves also dependencies.

Our library is using Log4j2 v. 2.10.0 and apparently enforce plugin complains that:

    log4j-api:jar:2.10.0:compile contains module-info.class targeted to JDK 1.9

Exactly I got:

[INFO] --- maven-enforcer-plugin:3.0.0-M1:enforce (enforce-bytecode-version) @ clj-log4j2-appender ---
[INFO] Restricted to JDK 1.7 yet org.apache.logging.log4j:log4j-api:jar:2.10.0:compile contains module-info.class targeted to JDK 1.9
[WARNING] Rule 0: org.apache.maven.plugins.enforcer.EnforceBytecodeVersion failed with message:
Found Banned Dependency: org.apache.logging.log4j:log4j-api:jar:2.10.0
Use 'mvn dependency:tree' to locate the source of the banned dependencies.

However

• our library is working very well on JDK 1.7 with given Log4j 2.10.0
• dependency tree did not show this module-info, as it is single class and not a package

Is then Enforcerer too sensitive? Handles Enforcerer correctly classes like module-info?

Issue Links

• relates to: HBASE-22927 Upgrade mockito version for Java 11 compatibility
• relates to: HBASE-20582 Bump up JRuby version because of some reported vulnerabilities