[SLING-11369] Provide Maven Enforcer rule which checks that provided dependencies are contained in the runtime Maven classpath

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Maven Enforcer Rules 1.0.0
• Component/s: Tooling
• Assignee: Konrad Windszus
• Reporter: Konrad Windszus
• Created: 02/Jun/22 11:14
• Updated: 23/Jun/22 08:11
• Resolved: 09/Jun/22 08:16

Description

All dependencies with provided scope are not transitively inherited. While this isn't a problem usually during compile time it is a problem for Maven plugins at run time, as they use the Maven dependency classpath also at run time (https://maven.apache.org/guides/mini/guide-maven-classloading.html#3-plugin-classloaders). At run time they fail if the (transitive) provided dependency has not been declared explicitly.

As manually specifying all transitive (but hidden) provided dependencies is a very error-prone process an enforcer rule for that would be highly beneficial. Especially as the transitive dependencies have to be rechecked once you upgrade to a newer version.

Example:

My Maven Plugin "A" -> 3rd Party Library "B" -> Provided Dependency "C"
As "B" uses "C" at run time it needs to be declared as dependency of "A" as well otherwise you might see java.lang.ClassNotFoundException when executing Maven plugin "A".

This was originally proposed in MENFORCER-385 but declined as considered too much of an edge case.
Compare with the discussion at https://lists.apache.org/thread/ttncrwmsnk29qy6n3on6ymfbq9s7dbnm

Issue Links

• blocks: JCRVLT-634 Make sure that vault-cli contains all necessary dependencies
• blocks: SLING-11386 Make sure that cp2fm contains all necessary runtime dependencies
• blocks: SLING-11408 Make sure that feature launcher contains only necessary runtime dependencies
• is caused by: MENFORCER-385 Enforce that transitive provided dependencies are contained in the runtime Maven classpath
• relates to: JCRVLT-394 Get rid of "provided" scope for FileVault dependencies
• relates to: SLING-10401 Ease usage of cp2fm as library
• relates to: SLING-11377 Onboard sling-maven-enforcer-rules to SonarCloud