unshaded jar contains Apache Ant, GSON, etc.

[Dominic Monroe]

My understanding is that the unshaded jar is supposed to use maven dependencies, rather than copies of dependencies included in the jar.  I've checked back on copies of the closure compiler on my machine, and this seems to go back to at least early 2021.

These commands will show you some of the copies included in the latest release:

  jar tf ~/.m2/repository/com/google/javascript/closure-compiler-unshaded/v20211107/closure-compiler-unshaded-v20211107.jar | grep 'apache'

  jar tf ~/.m2/repository/com/google/javascript/closure-compiler-unshaded/v20211107/closure-compiler-unshaded-v20211107.jar | grep 'gson'

This poses a problem for those of us using gson in our projects, as we can get unexpected errors where we get a different version of gson than the one we expected, with no way to correct enforce the version we want.

Thanks,

Dominic

[rish...@google.com]

closure-compiler-unshaded-v20200927.jar was the first release that includes the apache dependencies in the unshaded jar. The gson dependencies have existed since even before that.

The commits in between v20200920 and v20200927 are https://github.com/google/closure-compiler/compare/v20200920...v20200927 

Perhaps commit https://github.com/google/closure-compiler/commit/c9f3d327be6146a7d4de1f3d7c03feb36f49524a introduced this problem? 

[Dominic Monroe]

That seems likely, given it removed the <dependency> tags from the new poms, I couldn't figure out how those would be filled in otherwise.

[Dominic Monroe]

I've had a little poke around, and I believe in addition to updating the pom.xml to include the dependencies, line 47 of BUILD.bazel should point instead at :compiler_lib_no_runtime_libs.jar for the jar, instead of the current target.  The _unshaded jar is really the input jar to jarjar for shading, as in, it contains everything before it's been munged.

[Jan Kühle]

Thanks for looking into this Dominic. I created https://github.com/google/closure-compiler/issues/3896 to track the issue.

[co...@colinalworth.com]

I put together a draft patch and linked it from that issue - this tries to use the rules_jvm_external rules already in use in closure-compiler to generate a consistent pom and a jar suitable for non-shaded deployment to maven.  If this approach seems acceptable, I'd be happy to tidy it up and make a pull request.

[Bradford Smith]

I have responded on the issue.