Dependencies are not exposed to maven central causing build failure

Hello there,

At SW360, we are using org.spdx:tools-java:2.0.0 from maven central. However, I cannot see any dependency defined in project's pom.xml on central: https://central.sonatype.com/artifact/org.spdx/tools-java/2.0.0/dependencies

This causes our test cases to fail due to missing classes of various stores. Can you please help us with it?

java.lang.NoClassDefFoundError: org/spdx/spdxRdfStore/RdfStore
	at org.spdx.tools.SpdxToolsHelper.fileTypeToStore(SpdxToolsHelper.java:100)
	at org.spdx.tools.SpdxToolsHelper.deserializeDocumentCompatV2(SpdxToolsHelper.java:211)
	at org.eclipse.sw360.spdx.SpdxBOMImporter.openAsSpdx(SpdxBOMImporter.java:134)

If I add org.spdx:spdx-rdf-store:2.0.0 as dependency of my pom.xml, Java start complaining about java.lang.NoClassDefFoundError: org/spdx/v3jsonldstore/JsonLDStore

Link to PR: eclipse-sw360/sw360#3095

Failing test cases: https://github.com/eclipse-sw360/sw360/actions/runs/14570385211/job/40866454627?pr=3095#step:12:912

Thank you.
I can see there're changes in dependencies between 2.0.0-Alpha and 2.0.0-RC1.

pom.xml in the repo looks fine with dependencies in <dependencies /> section.

@GMishx

From a quick look, the dependency that is reported missing is present in the tools-java POM file:

	  <dependency>
	  	<groupId>org.spdx</groupId>
	  	<artifactId>spdx-rdf-store</artifactId>
	  	<version>2.0.0</version>
	  </dependency>

Note that the unit tests for the tools-java also depend on the spdx-rdf-store and are passing.

I noticed that the POM files in SW360 are referencing both the tools-java and the spdx-java-library - the latter shouldn't be needed since there is a transitive dependency to spdx-java-library. Other than that, I didn't see anything wrong in the PR from a cursory look.

@GMishx - perhaps running mvn test with the debug option -X will shed some light on where the issue is.

Thank you. I can see there're changes in dependencies between 2.0.0-Alpha and 2.0.0-RC1.

In the Maven Central pages, I found that the difference are those dependencies in the "COMPILE" scope.

@bact

In the Maven Central pages, I found that the difference are those dependencies in the "COMPILE" scope.

Thanks @bact for the pointer - I'll look into this.

@goneall

Hey @goneall , I had to add the spdx-java-library as a dependency to my pom.xml as tools-java only reports junit as its dependency and I start getting symbol missing errors:

[ERROR] /home/z003u7px/development/sw360/backend/common/src/main/java/org/eclipse/sw360/datahandler/db/ComponentDatabaseHandler.java:[73,21] package org.spdx.core does not exist
[ERROR] /home/z003u7px/development/sw360/backend/common/src/main/java/org/eclipse/sw360/spdx/SpdxBOMImporter.java:[36,21] package org.spdx.core does not exist
[ERROR] /home/z003u7px/development/sw360/backend/common/src/main/java/org/eclipse/sw360/spdx/SpdxBOMImporter.java:[37,21] package org.spdx.core does not exist
[ERROR] /home/z003u7px/development/sw360/backend/common/src/main/java/org/eclipse/sw360/spdx/SpdxBOMImporter.java:[38,46] package org.spdx.library.model.v2.enumerations does not exist

I am attaching the output of $ mvn clean package -Dbase.deploy.dir=. -DskipTests=true -X -U as requested for you to look at: logs.txt

Even mvn dependency:tree says org.spdx:tools-java:jar:2.0.0:compile has no transitive dependency.

$ mvn dependency:tree
Picked up _JAVA_OPTIONS: -Djdk.net.URLClassPath.disableClassPathURLCheck=true -Djdk.util.zip.disableZip64ExtraFieldValidation=true
[INFO] Scanning for projects...
[INFO] 
[INFO] ------------------< org.eclipse.sw360:backend-common >------------------
[INFO] Building backend-common 19.2.0
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ backend-common ---
[INFO] org.eclipse.sw360:backend-common:jar:19.2.0
[INFO] +- org.eclipse.sw360:backend-service-core:jar:19.2.0:compile
[INFO] +- org.spdx:tools-java:jar:2.0.0:compile
[INFO] +- org.cyclonedx:cyclonedx-core-java:jar:10.2.1:compile
[INFO] |  +- commons-codec:commons-codec:jar:1.18.0:compile
[INFO] |  +- commons-io:commons-io:jar:2.18.0:compile
[INFO] |  +- org.apache.commons:commons-lang3:jar:3.17.0:compile
[INFO] |  +- org.apache.commons:commons-collections4:jar:4.4:compile
[INFO] |  +- com.github.package-url:packageurl-java:jar:1.5.0:compile
[INFO] |  +- com.fasterxml.jackson.dataformat:jackson-dataformat-xml:jar:2.18.3:compile
[INFO] |  |  +- org.codehaus.woodstox:stax2-api:jar:4.2.2:compile
[INFO] |  |  \- com.fasterxml.woodstox:woodstox-core:jar:7.0.0:compile
[INFO] |  \- com.networknt:json-schema-validator:jar:1.5.6:compile
[INFO] |     +- com.ethlo.time:itu:jar:1.10.3:compile
[INFO] |     \- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.18.1:compile
[INFO] |        \- org.yaml:snakeyaml:jar:2.3:compile
..
Chopped for brevity.
..
[INFO] +- org.eclipse.sw360:datahandler:test-jar:tests:19.2.0:test
[INFO] +- org.eclipse.sw360:build-configuration:jar:19.2.0:compile
[INFO] +- org.eclipse.sw360:build-configuration:test-jar:tests:19.2.0:test
[INFO] \- jakarta.mail:jakarta.mail-api:jar:2.0.1:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.579 s
[INFO] Finished at: 2025-04-23T16:47:08+05:30
[INFO] ------------------------------------------------------------------------

@goneall

@goneall I have near zero knowledge about releasing distribution on Maven Central, but which jar will be downloaded with this:

<dependency>
    <groupId>org.spdx</groupId>
    <artifactId>tools-java</artifactId>
    <version>2.0.0</version>
</dependency>

as our build will produce two jars (excluding javadoc.jar), one with dependencies and one without.

Does there a chance this is something to do with shading?

When browsing https://central.sonatype.com/artifact/org.spdx/tools-java/2.0.0/dependencies with "Dependency Type: Indirect" it shows none.

I'm able to duplicate the problem with just a very simple POM file with the tools-java dependency. No indirect dependencies show up.

Removing the Shade plugin solved the problem.

Now the question is "why" and how do we fix it?

The Shade plugin is used to generate the "jar-with-dependencies". I would not expect it to interfere with the actual Jar file.

I'll do a bit more digging.

I verified that this broke in the 2.0.0-RC1 build. The last working build was v1.1.8.

I compare the 2 POM files and experimented with the differences in the Shade file configuration, matching the same values as v1.1.8 and the problem still occurs. Quite a mystery.

I just checked out the tools-java version 1.1.8 and rebuilt it with no modifications. All the dependencies disappeared. So it looks like this is due to some change to Maven and not a change to tools-java.

Maybe we take this opportunity to try the nexus-staging-maven-plugin ?

(and also fix this spdx/Spdx-Java-Library#315 ?)

But "COMPILE" scope dependencies in libraries like spdx-java-core etc looks fine, hmm.

I think I found the source of the issue - this is an intentional update to the shade plugin - reference: https://issues.apache.org/jira/browse/HIVE-28455

We can fix this by forcing the earlier (working) version of the Shade plugin.

The suggestion is to publish 2 separate artifact IDs, but all our documentation points to generated a jar with dependencies + the shaded jar. I personally disagree with the logic expressed in the referenced issue since we're using Shade to generate a separate JAR file for a different intended use.

Fix Shade plugin version to 3.2.4

@GMishx

@GMishx - Thanks for reporting the issue.

If you want a temporary workaround, you can manually add back all the dependencies in your POM file:

<dependencies>
	  <dependency>
	    <groupId>commons-io</groupId>
	    <artifactId>commons-io</artifactId>
	    <version>2.16.1</version>
	  </dependency>
	  <dependency>
	    <groupId>org.apache.commons</groupId>
	    <artifactId>commons-compress</artifactId>
	    <version>1.27.1</version>
	  </dependency>
	  <dependency>
	  	<groupId>org.apache.ws.xmlschema</groupId>
	  	<artifactId>xmlschema-core</artifactId>
	  	<version>2.3.1</version>
	  </dependency>
	  <dependency>
	    <groupId>junit</groupId>
	    <artifactId>junit</artifactId>
	    <version>4.13.2</version>
	    <scope>test</scope>
	  </dependency>
	  <dependency>
	  	<groupId>org.spdx</groupId>
	  	<artifactId>java-spdx-library</artifactId>
	  	<version>2.0.0</version>
	  </dependency>
	  <dependency>
	  	<groupId>org.spdx</groupId>
	  	<artifactId>spdx-rdf-store</artifactId>
	  	<version>2.0.0</version>
	  </dependency>
	  <dependency>
	  	<groupId>org.spdx</groupId>
	  	<artifactId>spdx-jackson-store</artifactId>
	  	<version>2.0.0</version>
	  </dependency>
	  <dependency>
	  	<groupId>org.spdx</groupId>
	  	<artifactId>spdx-spreadsheet-store</artifactId>
	  	<version>2.0.0</version>
	  </dependency>
	  <dependency>
	  	<groupId>org.spdx</groupId>
	  	<artifactId>spdx-tagvalue-store</artifactId>
	  	<version>2.0.0</version>
	  </dependency>
	  <dependency>
	  	<groupId>org.spdx</groupId>
	  	<artifactId>spdx-v3jsonld-store</artifactId>
	  	<version>1.0.0</version>
	  </dependency>
	  <dependency>
	  	<groupId>com.networknt</groupId>
	  	<artifactId>json-schema-validator</artifactId>
	  	<version>1.5.6</version>
	  </dependency>
	  <dependency>
	  	<groupId>org.slf4j</groupId>
	  	<artifactId>slf4j-simple</artifactId>
	  	<version>2.0.17</version>
	  	<optional>true</optional>
	  </dependency>
		<dependency>
			<groupId>org.apache.poi</groupId>
			<artifactId>poi</artifactId>
			<version>5.4.1</version>
			<scope>compile</scope>
		</dependency>
		<dependency>
			<groupId>org.apache.jena</groupId>
			<artifactId>jena-core</artifactId>
			<version>5.2.0</version>
			<scope>compile</scope>
		</dependency>
	</dependencies>

@bact

Thanks for digging @bact and @goneall .

I'll prefer to wait until the issue is resolved rather than fixing my pom.xml twice 😛

I see the PR is merged with the fix. Will you be releasing a new version (presumably 2.0.1)?

Fix Shade plugin version to 3.2.4

I see the PR is merged with the fix. Will you be releasing a new version (presumably 2.0.1)?

I have another dependency that is being updated, once that's released I'll do a patch release for the tools-java - likely today.

@GMishx

@GMishx - I just release version 2.0.1 which should fix this issue. Let me know if you have any other issues.

I just updated my branch with 2.0.1 and everything is working again. Thank you for the quick fix!

Sync with original repository (#1)

Navigation Menu

Repository navigation

Dependencies are not exposed to maven central causing build failure #201

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Dependencies are not exposed to maven central causing build failure #201

Description

Activity

bact commented on Apr 22, 2025

bact commented on Apr 22, 2025

goneall commented on Apr 22, 2025

bact commented on Apr 22, 2025

goneall commented on Apr 23, 2025

GMishx commented on Apr 23, 2025

bact commented on Apr 23, 2025

goneall commented on Apr 23, 2025

goneall commented on Apr 23, 2025

goneall commented on Apr 23, 2025

bact commented on Apr 23, 2025

bact commented on Apr 23, 2025

goneall commented on Apr 23, 2025

goneall commented on Apr 23, 2025

GMishx commented on Apr 24, 2025

GMishx commented on Apr 28, 2025

goneall commented on Apr 28, 2025

goneall commented on Apr 28, 2025

GMishx commented on Apr 29, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions