support for adding a BOM pom as dependency

[aaronwalker]

would be cool to be able to use a BOM pom to define the versions for related dependencies so you don't need to provide specific versions

//DEPS com.azure:azure-sdk-bom:1.0.0-beta.1 com.azure:azure-identity com.azure:azure-security-keyvault-secrets

maybe prefix it with something pom: or it should be possible to determine it from the type

[maxandersen]

Good idea - not sure if I can do that without shrink-wrap but let's see

On Thu, 20 Feb 2020 at 13:06, Aaron Walker ***@***.***> wrote: would be cool to be able to use a BOM pom to define the versions for related dependencies so you don't need to provide specific versions //DEPS com.azure:azure-sdk-bom:1.0.0-beta.1 com.azure:azure-identity com.azure:azure-security-keyvault-secrets maybe prefix it with something pom: or it should be possible to determine it from the type — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <https://github.com/maxandersen/jbang/issues/63?email_source=notifications&email_token=AAANG4IL3MZKCYO6ZUK7WHLRDZ56ZA5CNFSM4KYOPGJ2YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4IO7L52Q>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAANG4NB3QL5AIZPDUON4ITRDZ56ZANCNFSM4KYOPGJQ> .

-- /max http://about.me/maxandersen

[maxandersen]

com.azure:azure-sdk-bom:1.0.0-beta.1 doesn't seem to exist ?

[aaronwalker]

@maxandersen hmm ok try 1.0.0.M1

[maxandersen]

so figured out the proper artifact names:

//DEPS com.microsoft.azure:azure-bom:1.0.0.M1@pom
//DEPS com.microsoft.azure:azure

unfortunately jcabi-aether does not seem to support import bom notion so will have to wait until I try again to get shrinkwrap to work which does seem to support it.

[maxandersen]

i've tried several ways to get shrinkwrap to honor import scope but no luck yet. If anyone have an idea do share :)

[quintesse]

i've tried several ways to get shrinkwrap to honor import scope but no luck yet.

Could you elaborate? I'm not sure what the problem is.

[maxandersen]

shrinkwrap doesn't have support for straight up just resolving a pom and put it in importscope (like maven does).

what it does allow though is fetch the pom and have it load a pom into importscope thus that was my thinking to do this trick with each dep marked as @pom before resolving everything else.

[maxandersen]

writing this down so I dont forget:

shrinkwrap does not support fetching POM's (it actively filters it out of any result), see https://github.com/shrinkwrap/resolver/blob/master/maven/impl-maven/src/main/java/org/jboss/shrinkwrap/resolver/impl/maven/PostResolutionFilterApplicator.java#L51

A quick'n'dirty workaround would be to make a fork of shrinkwrap (jbang-shrinkwrap) that would not do this filtering for the cases jbang needs.

Then we could at least fetch the pom and get the managed dependencies to fill in versions when they are not specified.

[quintesse]

And could we perhaps do a feature request for this in upstream? They might be willing.

Edit: for example, I see that it's nicely designed to apply "post filter" but then it just uses a single hard-coded one. So perhaps they wouldn't mind if someone extended that to a configurable list of filters (with the current one being the default).

[maxandersen]

Unfortunately not found much activity up there. But yes; idea is to get something upstream but don't want to keep wait :)