[METRON-734] Builds failing because of MaxMind DB transitive dependency

• Type: Bug
• Status: Done
• Priority: Major
• Resolution: Done
• Fix Version/s: 0.3.1
• Assignee: Justin Leet
• Reporter: Justin Leet
• Created: 22/Feb/17 14:02
• Updated: 28/Feb/17 12:50
• Resolved: 28/Feb/17 12:50

Description

Original Error

[ERROR] Failed to execute goal on project metron-enrichment: Could not resolve dependencies for project org.apache.metron:metron-enrichment:jar:0.3.1: Failed to collect dependencies at com.maxmind.geoip2:geoip2:jar:2.8.0 -> com.maxmind.db:maxmind-db:jar:1.2.1 -> com.fasterxml.jackson.core:jackson-databind:jar:2.9.0-SNAPSHOT: Failed to read artifact descriptor for com.fasterxml.jackson.core:jackson-databind:jar:2.9.0-SNAPSHOT: Failure to find com.fasterxml:oss-parent:pom:28 in http://clojars.org/repo was cached in the local repository, resolution will not be reattempted until the update interval of clojars.org has elapsed or updates are forced -> [Help 1]

Discussion on the lib
https://github.com/maxmind/GeoIP2-java/issues/77

The geoip2 lib from MaxMind has a transitive dependency on open ended version range of jackson-databind. This causes it to try to use 2.9.0-SNAPSHOT, rather than a distinct version.

The easy answer is to just exclude jackson from being pulled in by geoip2 lib, and use our own. The catch is that the version geoip declares in its POM is higher than the version we use and I don't know if that causes any problems (I'm guessing not, since it's going from 2.7.x to 2.8.x, but I haven't tested it).

If there's a way to skip snapshots that might also contribute to solving our problem, but I still don't like the unrepeatability of the build if they depend on an open ended range.

Issue Links

• links to: GitHub Pull Request #462