Abhishek Kumar created RANGER-5832:
--------------------------------------
Summary: CI build fails on Maven 3.10.0 due to duplicate
dependency declarations in audit-dispatcher-hdfs and audit-dispatcher-solr POMs
Key: RANGER-5832
URL: https://issues.apache.org/jira/browse/RANGER-5832
Project: Ranger
Issue Type: Bug
Components: audit-server, Ranger
Reporter: Abhishek Kumar
Assignee: Abhishek Kumar
Problem
-------
The Ranger build fails before any module is compiled when it runs on Maven
3.10.0, which GitHub Actions runners now pick up. Two modules declare the same
dependencies twice in their <dependencies> section:
- audit-server/audit-dispatcher/dispatcher-hdfs/pom.xml
- audit-server/audit-dispatcher/dispatcher-solr/pom.xml
The duplicated dependencies are:
- ch.qos.logback:logback-classic
- com.fasterxml.jackson.core:jackson-databind
- com.google.guava:guava
- commons-io:commons-io
- javax.servlet:javax.servlet-api
- org.apache.commons:commons-lang3
Each one is declared once near the top of <dependencies> with no scope, and
again further down with <scope>provided</scope>. The duplicates were added by
RANGER-5520 (commit 3fd46dbef8).
Maven 3.9.x only logs a warning for this. Maven 3.10.0 treats it as a fatal
model-building error:
[ERROR] 'dependencies.dependency.(groupId:artifactId:type:classifier)' must
be unique:
ch.qos.logback:logback-classic:jar -> duplicate declaration of
version ${logback.version} @ line 212, column 21
...
[ERROR] The build could not read 2 projects -> [Help 1]
[ERROR] The project org.apache.ranger:audit-dispatcher-hdfs:3.0.0-SNAPSHOT
(.../dispatcher-hdfs/pom.xml) has 6 errors
[ERROR] The project org.apache.ranger:audit-dispatcher-solr:3.0.0-SNAPSHOT
(.../dispatcher-solr/pom.xml) has 6 errors
As a result, every CI run on a Maven 3.10.0 runner fails, on master and on all
open PRs. Example:
https://github.com/apache/ranger/actions/runs/37738426735/job/113183220920
Steps to reproduce
------------------
1. Install Maven 3.10.0.
2. From the repo root, run: mvn -T 8 clean verify
3. The build fails during project scanning with the errors above.
Proposed fix
------------
In both POMs, remove the first, unscoped declaration of each of the six
dependencies and keep the <scope>provided</scope> ones. Under Maven 3.9.x the
later declaration takes effect, so the effective scope is already "provided"
and the packaged artifacts should not change.
Verification
------------
- mvn validate passes on Maven 3.9.x and 3.10.0.
- mvn clean verify passes, given the RANGER-5759 revert
(https://github.com/apache/ranger/pull/1298) is also in place.
- The dependency tree for the two modules (mvn dependency:tree -pl <module>)
is the same before and after the change.
Related
-------
- RANGER-5520: introduced the duplicate declarations.
- RANGER-5759 revert (https://github.com/apache/ranger/pull/1298): fixes a
separate compile failure in ranger-atlas-plugin-shim that is also on master.
Both fixes are needed for a green build.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
