[MENFORCER-414] Architecture-specific versions of library wrongly flagged by dependency convergence rule

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.0.0
• Fix Version/s: waiting-for-feedback
• Component/s: Plugin
• Assignee: Unassigned
• Reporter: Vladimir B
• Created: 24/Mar/22 16:07
• Updated: 02/Jun/22 16:49

Description

I get the following warning reported by the dependency convergence rule of the plugin:

Dependency convergence error for io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile paths to dependency are:
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-com.twitter:finagle-http2_2.12:jar:22.2.0:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:linux-x86_64:2.0.48.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:linux-aarch_64:2.0.48.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:osx-x86_64:2.0.48.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:osx-aarch_64:2.0.48.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:windows-x86_64:2.0.48.Final:compile

It seems that the conflicting library is seen as being the same for all the paths, while in fact there are architecture-specific versions of the same library, which shouldn't be treated as the same library in my opinion.