[
https://issues.apache.org/jira/browse/RANGER-5832?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Abhishek Kumar resolved RANGER-5832.
------------------------------------
Fix Version/s: 3.0.0
Resolution: Fixed
Merged in master:
[https://github.com/apache/ranger/commit/1a03f65710be5e49168702501e8e617137caf65a]
> CI build fails on Maven 3.10.0 due to duplicate dependency declarations in
> audit-dispatcher-hdfs and audit-dispatcher-solr POMs
> -------------------------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5832
> URL: https://issues.apache.org/jira/browse/RANGER-5832
> Project: Ranger
> Issue Type: Bug
> Components: audit-server, Ranger
> Reporter: Abhishek Kumar
> Assignee: Abhishek Kumar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Problem
> -------
> The Ranger build fails before any module is compiled when it runs on Maven
> 3.10.0, which GitHub Actions runners now pick up. Two modules declare the
> same dependencies twice in their <dependencies> section:
> - audit-server/audit-dispatcher/dispatcher-hdfs/pom.xml
> - audit-server/audit-dispatcher/dispatcher-solr/pom.xml
> The duplicated dependencies are:
> - ch.qos.logback:logback-classic
> - com.fasterxml.jackson.core:jackson-databind
> - com.google.guava:guava
> - commons-io:commons-io
> - javax.servlet:javax.servlet-api
> - org.apache.commons:commons-lang3
> Each one is declared once near the top of <dependencies> with no scope, and
> again further down with <scope>provided</scope>. The duplicates were added by
> RANGER-5520 (commit 3fd46dbef8).
> Maven 3.9.x only logs a warning for this. Maven 3.10.0 treats it as a fatal
> model-building error:
> [ERROR] 'dependencies.dependency.(groupId:artifactId:type:classifier)' must
> be unique:
> ch.qos.logback:logback-classic:jar -> duplicate declaration of
> version ${logback.version} @ line 212, column 21
> ...
> [ERROR] The build could not read 2 projects -> [Help 1]
> [ERROR] The project
> org.apache.ranger:audit-dispatcher-hdfs:3.0.0-SNAPSHOT
> (.../dispatcher-hdfs/pom.xml) has 6 errors
> [ERROR] The project
> org.apache.ranger:audit-dispatcher-solr:3.0.0-SNAPSHOT
> (.../dispatcher-solr/pom.xml) has 6 errors
> As a result, every CI run on a Maven 3.10.0 runner fails, on master and on
> all open PRs. Example:
> https://github.com/apache/ranger/actions/runs/37738426735/job/113183220920
> Steps to reproduce
> ------------------
> 1. Install Maven 3.10.0.
> 2. From the repo root, run: mvn -T 8 clean verify
> 3. The build fails during project scanning with the errors above.
> Proposed fix
> ------------
> In both POMs, remove the first, unscoped declaration of each of the six
> dependencies and keep the <scope>provided</scope> ones. Under Maven 3.9.x the
> later declaration takes effect, so the effective scope is already "provided"
> and the packaged artifacts should not change.
> Verification
> ------------
> - mvn validate passes on Maven 3.9.x and 3.10.0.
> - mvn clean verify passes, given the RANGER-5759 revert
> (https://github.com/apache/ranger/pull/1298) is also in place.
> - The dependency tree for the two modules (mvn dependency:tree -pl
> <module>) is the same before and after the change.
> Related
> -------
> - RANGER-5520: introduced the duplicate declarations.
> - RANGER-5759 revert (https://github.com/apache/ranger/pull/1298): fixes a
> separate compile failure in ranger-atlas-plugin-shim that is also on master.
> Both fixes are needed for a green build.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
