Jar version collision with Maven Overlay

[Jonathan Labin]

I'm running CAS 4.1.3 and using the maven overlay from: https://github.com/Jasig/cas-overlay-template and I'm running into a problem where my resulting war file contains multiple versions of the same jar file.

There are a few cases of this but the one giving me trouble right now is spring-core.

person-directory-impl-1.7.1 brings in spring-context-4.2.4.RELEASE which of course leads to spring-core-4.2.4.RELEASE.

However I'm finding that my resulting war also contains spring-core-4.1.8.RELEASE.  I've tried adding a block to resolve this collision:

<dependencyManagement>

<dependencies>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-core</artifactId>

<version>4.2.4.RELEASE</version>

</dependency>

</dependencies>

</dependencyManagement>

but it seems to have no effect.

I noticed that cas-server-webapp-4.1.3.war contains spring-core-4.1.8.RELEASE.  

Is the cop of spring-core-4.1.8 that ultimately ends up in my war coming from thie cas-server-webapp-4.1.3.war and not the maven dependency tree?  This would explain why my dependencyManagement block had no effect.

If this is the case, how to I keep old versions of the colliding jars that are a part of the base war dependency from showing up in my final war built by the overlay task?

Thanks

[John Gasper]

You can see how to keep various files from being included in the final build here: https://github.com/Unicon/unicon-cas-overlay/blob/master/pom.xml#L20-L46

You can also exclude the dependency itself: https://github.com/Unicon/unicon-cas-overlay/blob/master/pom.xml#L89-L104

If the undesired file is in the baseline cas.war you need to use the first method. If it is being pulled from a dependency, then I prefer using the latter. You can call `mvn dependency:tree` to find out what is contributing what. If it isn't listed then it is probably in the baseline cas.war.

-- 

John Gasper
IAM Consultant
Unicon, Inc.
PGP/GPG Key: 0xbafee3ef

--
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.

[Jonathan Labin]

Is this a correction to need to make in an overlay project?  It seems that you'd want the jars to be all populated from the pom to avoid just this situation.

[Jonathan Labin]

Sorry, i mean to ask if this is a *common* correction to need to make in an overlay project....

[John Gasper]

I would argue yes, in many cases it is… The problem seems to be that Maven does not take into account libs that are apart of the war, so if a dependency that's being added to the overlay pom conflicts with what's in the pom, then there are issues. This is not a thoroughly researched opinion, but just one from experience… If you look into the CAS MFA project you'll notice may times where this is needed because of the multiple overlays used by that.