chore(project): generate third-party BOMs

- a third-party BOM is a list of all non-Camunda dependencies that we include in our own artifacts (e.g. WAR file libraries, zip distro libraries, shaded libraries) - these BOM files are consumed by the license book generator to create a license book - this commit cleans up some dependencies and their scopes in order for the BOMs to be as accurate as possible - for JARs that shade some of their dependencies, the BOM includes all dependencies (which is too much with respect to the license book); this is the most robust solution that I could find as it is not easy to just list the shaded libraries without duplication of dependency names that can lead to inconsistencies in the future - updates Spin and Connect to latest versions related to CAM-10419
CapBPM · Apr 30, 2020 · b7b1897 · b7b1897
1 parent 101491b
commit b7b1897
Show file tree

Hide file tree

Showing 19 changed files with 131 additions and 63 deletions.
diff --git a/distro/jbossas7/modules/pom.xml b/distro/jbossas7/modules/pom.xml
@@ -13,6 +13,10 @@
 
   <properties>
     <org.jboss.shrinkwrap.resolver.version>1.0.0-beta-5</org.jboss.shrinkwrap.resolver.version>
+    <!-- generate a bom of compile time dependencies for the license book.
+    Note: Every compile time dependency will end up in the license book. Please
+    declare only dependencies that are actually needed -->
+    <skip-third-party-bom>false</skip-third-party-bom>
   </properties>
 
   <dependencies>
@@ -33,10 +37,6 @@
           <groupId>commons-lang</groupId>
           <artifactId>commons-lang</artifactId>
         </exclusion>
-        <exclusion>
-          <groupId>joda-time</groupId>
-          <artifactId>joda-time</artifactId>
-        </exclusion>
       </exclusions>
     </dependency>
 

diff --git a/distro/jbossas7/webapp-standalone/pom.xml b/distro/jbossas7/webapp-standalone/pom.xml
@@ -13,6 +13,13 @@
   <packaging>war</packaging>
   <name>camunda BPM - webapp - JBoss Standalone</name>
 
+  <properties>
+    <!-- generate a bom of compile time dependencies for the license book.
+    Note: Every compile time dependency will end up in the license book. Please
+    declare only dependencies that are actually needed -->
+    <skip-third-party-bom>false</skip-third-party-bom>
+  </properties>
+
   <dependencyManagement>
     <dependencies>
       <dependency>
@@ -74,12 +81,10 @@
       <artifactId>camunda-webapp-jboss</artifactId>
       <version>${project.version}</version>
       <type>war</type>
-      <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.camunda.bpm</groupId>
       <artifactId>camunda-engine</artifactId>
-      <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.camunda.bpm</groupId>

diff --git a/distro/jbossas7/webapp/pom.xml b/distro/jbossas7/webapp/pom.xml
@@ -11,6 +11,13 @@
   <name>camunda BPM - webapp - JBoss</name>
   <artifactId>camunda-webapp-jboss</artifactId>
   <packaging>war</packaging>
+
+  <properties>
+    <!-- generate a bom of compile time dependencies for the license book.
+    Note: Every compile time dependency will end up in the license book. Please
+    declare only dependencies that are actually needed -->
+    <skip-third-party-bom>false</skip-third-party-bom>
+  </properties>
 
   <dependencies>
     <dependency>

diff --git a/distro/run/assembly/pom.xml b/distro/run/assembly/pom.xml
@@ -13,19 +13,40 @@
   <name>Camunda BPM - Run - Assembly</name>
   <packaging>pom</packaging>
 
+  <properties>
+    <!-- generate a bom of compile time dependencies for the license book.
+    Note: Every compile time dependency will end up in the license book. Please
+    declare only dependencies that are actually needed -->
+    <skip-third-party-bom>false</skip-third-party-bom>
+  </properties>
+
   <dependencies>
     <!-- make sure the assembly runs after the REST module -->
     <dependency>
       <groupId>org.camunda.bpm.run</groupId>
       <artifactId>camunda-bpm-run-modules-rest</artifactId>
       <version>${project.version}</version>
       <type>pom</type>
+      <exclusions>
+        <!-- do not add transitive dependencies to generated dependency list -->
+        <exclusion>
+          <groupId>*</groupId>
+          <artifactId>*</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
 
     <dependency>
       <groupId>org.camunda.bpm.run</groupId>
       <artifactId>camunda-bpm-run-core</artifactId>
       <version>${project.version}</version>
+      <exclusions>
+        <!-- we consume an uberjar that contains all of its dependencies -->
+        <exclusion>
+          <groupId>*</groupId>
+          <artifactId>*</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
 
     <dependency>

diff --git a/distro/run/core/pom.xml b/distro/run/core/pom.xml
@@ -13,6 +13,15 @@
   <name>Camunda BPM - Run - Core</name>
   <packaging>jar</packaging>
 
+  <properties>
+    <!-- generate a bom of compile time dependencies for the license book.
+    Note: Every compile time dependency will end up in the license book. Please
+    declare only dependencies that are actually needed -->
+    <skip-third-party-bom>false</skip-third-party-bom>
+    <!-- snakeyaml is in Spring Boot's runtime scope and then included in our uberjar -->
+    <third-party-bom-scopes>compile|runtime</third-party-bom-scopes>
+  </properties>
+
   <dependencies>
 
     <dependency>
@@ -38,7 +47,6 @@
     <dependency>
       <groupId>org.camunda.bpm.springboot</groupId>
       <artifactId>camunda-bpm-spring-boot-starter-rest</artifactId>
-      <scope>provided</scope>
     </dependency>
 
     <dependency>

diff --git a/distro/run/distro/pom.xml b/distro/run/distro/pom.xml
@@ -15,11 +15,6 @@
 
   <dependencies>
 
-    <dependency>
-      <groupId>com.h2database</groupId>
-      <artifactId>h2</artifactId>
-    </dependency>
-
     <dependency>
       <groupId>org.camunda.bpm.run</groupId>
       <artifactId>camunda-bpm-run-assembly</artifactId>
@@ -40,6 +35,13 @@
       <artifactId>camunda-bpm-run-modules-webapps</artifactId>
       <version>${project.version}</version>
       <type>pom</type>
+      <exclusions>
+        <!-- we don't need any transitive dependencies -->
+        <exclusion>
+          <groupId>*</groupId>
+          <artifactId>*</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
 
   </dependencies>

diff --git a/distro/run/modules/rest/pom.xml b/distro/run/modules/rest/pom.xml
@@ -12,6 +12,13 @@
   <artifactId>camunda-bpm-run-modules-rest</artifactId>
   <name>Camunda BPM - Run - Module REST</name>
   <packaging>pom</packaging>
+
+  <properties>
+    <!-- generate a bom of compile time dependencies for the license book.
+    Note: Every compile time dependency will end up in the license book. Please
+    declare only dependencies that are actually needed -->
+    <skip-third-party-bom>false</skip-third-party-bom>
+  </properties>
 
   <dependencies>
 

diff --git a/distro/run/modules/webapps/pom.xml b/distro/run/modules/webapps/pom.xml
@@ -12,7 +12,14 @@
   <artifactId>camunda-bpm-run-modules-webapps</artifactId>
   <name>camunda BPM - Run - Module Webapps</name>
   <packaging>pom</packaging>
-
+
+  <properties>
+    <!-- generate a bom of compile time dependencies for the license book.
+    Note: Every compile time dependency will end up in the license book. Please
+    declare only dependencies that are actually needed -->
+    <skip-third-party-bom>false</skip-third-party-bom>
+  </properties>
+
   <dependencies>
 
     <dependency>

diff --git a/distro/tomcat/assembly/pom.xml b/distro/tomcat/assembly/pom.xml
@@ -14,6 +14,10 @@
     <artifactId>camunda-tomcat</artifactId>
     <version>7.13.0-SNAPSHOT</version>
   </parent>
+
+  <properties>
+    <skip-third-party-bom>false</skip-third-party-bom>
+  </properties>
 
   <name>camunda BPM - tomcat Assembly</name>
 
@@ -24,11 +28,6 @@
       <version>${version.tomcat}</version>
       <type>tar.gz</type>
     </dependency>
-    <dependency>
-      <groupId>org.apache.tomcat</groupId>
-      <artifactId>tomcat-jdbc</artifactId>
-      <version>${version.tomcat}</version>
-    </dependency>
 
     <dependency>
       <groupId>com.h2database</groupId>
@@ -53,18 +52,23 @@
     <dependency>
       <groupId>org.camunda.bpm</groupId>
       <artifactId>camunda-engine</artifactId>
+      <exclusions>
+        <exclusion>
+          <groupId>org.springframework</groupId>
+          <artifactId>spring-beans</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.springframework</groupId>
+          <artifactId>spring-core</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
 
     <dependency>
       <groupId>org.camunda.bpm</groupId>
       <artifactId>camunda-engine-cdi</artifactId>
     </dependency>
 
-    <dependency>
-      <groupId>org.camunda.bpm</groupId>
-      <artifactId>camunda-engine-spring</artifactId>
-    </dependency>
-
     <dependency>
       <groupId>org.camunda.bpm.identity</groupId>
       <artifactId>camunda-identity-ldap</artifactId>
@@ -100,25 +104,13 @@
       <artifactId>camunda-connect-connectors-all</artifactId>
     </dependency>
 
-    <dependency>
-      <groupId>org.camunda.bpm</groupId>
-      <artifactId>camunda-engine-rest</artifactId>
-      <classifier>classes</classifier>
-      <version>${project.version}</version>
-    </dependency>
-
     <dependency>
       <groupId>org.camunda.bpm</groupId>
       <artifactId>license-book</artifactId>
       <version>${project.version}</version>
       <type>zip</type>
     </dependency>
 
-    <dependency>
-      <groupId>org.freemarker</groupId>
-      <artifactId>freemarker</artifactId>
-    </dependency>
-
     <dependency>
       <groupId>org.camunda.template-engines</groupId>
       <artifactId>camunda-template-engines-freemarker</artifactId>

diff --git a/distro/tomcat/webapp-standalone/pom.xml b/distro/tomcat/webapp-standalone/pom.xml
@@ -13,6 +13,10 @@
   <packaging>war</packaging>
   <name>camunda BPM - webapp - Tomcat Standalone</name>
 
+  <properties>
+    <skip-third-party-bom>false</skip-third-party-bom>
+  </properties>
+
   <dependencyManagement>
     <dependencies>
       <dependency>
@@ -74,12 +78,10 @@
       <artifactId>camunda-webapp-tomcat</artifactId>
       <version>${project.version}</version>
       <type>war</type>
-      <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.camunda.bpm</groupId>
       <artifactId>camunda-engine</artifactId>
-      <scope>runtime</scope>
     </dependency>
     <dependency>
       <groupId>org.camunda.bpm</groupId>

diff --git a/distro/tomcat/webapp/pom.xml b/distro/tomcat/webapp/pom.xml
@@ -11,6 +11,10 @@
   <groupId>org.camunda.bpm.webapp</groupId>
   <artifactId>camunda-webapp-tomcat</artifactId>
   <packaging>war</packaging>
+
+  <properties>
+    <skip-third-party-bom>false</skip-third-party-bom>
+  </properties>
 
   <dependencies>
     <dependency>

diff --git a/distro/wildfly/assembly/pom.xml b/distro/wildfly/assembly/pom.xml
@@ -16,6 +16,13 @@
     Assembles the camunda BPM platform and makes it ready for qa.
     The assembly is installed to maven later in the reactor, if the integration tests pass successfully
   </description>
+
+  <properties>
+    <!-- generate a bom of compile time dependencies for the license book.
+    Note: Every compile time dependency will end up in the license book. Please
+    declare only dependencies that are actually needed -->
+    <skip-third-party-bom>false</skip-third-party-bom>
+  </properties>
 
   <dependencies>
     <dependency>

diff --git a/distro/wildfly/modules/pom.xml b/distro/wildfly/modules/pom.xml
@@ -16,6 +16,10 @@
     <version.jackson>2.10.0</version.jackson>
     <version.jackson.databind>${version.jackson}</version.jackson.databind>
     <version.jackson.annotations>${version.jackson}</version.jackson.annotations>
+    <!-- generate a bom of compile time dependencies for the license book.
+    Note: Every compile time dependency will end up in the license book. Please
+    declare only dependencies that are actually needed -->
+    <skip-third-party-bom>false</skip-third-party-bom>
   </properties>
 
   <dependencies>
@@ -36,10 +40,6 @@
           <groupId>commons-lang</groupId>
           <artifactId>commons-lang</artifactId>
         </exclusion>
-        <exclusion>
-          <groupId>joda-time</groupId>
-          <artifactId>joda-time</artifactId>
-        </exclusion>
       </exclusions>
     </dependency>
 

diff --git a/engine-dmn/feel-juel/pom.xml b/engine-dmn/feel-juel/pom.xml
@@ -11,6 +11,12 @@
   <artifactId>camunda-engine-feel-juel</artifactId>
   <name>camunda DMN - engine FEEL - JUEL</name>
 
+  <properties>
+    <!-- We shade artifacts into the jar, so we need to generate 
+    a dependency BOM for the license book -->
+    <skip-third-party-bom>false</skip-third-party-bom>
+  </properties>
+
   <dependencies>
     <dependency>
       <groupId>org.camunda.bpm.dmn</groupId>

diff --git a/engine-dmn/feel-scala/pom.xml b/engine-dmn/feel-scala/pom.xml
@@ -10,6 +10,12 @@
   <artifactId>camunda-engine-feel-scala</artifactId>
   <name>camunda DMN - engine FEEL - SCALA</name>
 
+  <properties>
+    <!-- We shade artifacts into the jar, so we need to generate 
+    a dependency BOM for the license book -->
+    <skip-third-party-bom>false</skip-third-party-bom>
+  </properties>
+
   <dependencies>
 
     <dependency>

diff --git a/engine-rest/assembly/pom.xml b/engine-rest/assembly/pom.xml
@@ -10,6 +10,15 @@
     <relativePath>../</relativePath>
     <version>7.13.0-SNAPSHOT</version>
   </parent>
+
+  <properties>
+    <!-- generate a bom of dependencies for the license book.
+    We include compile and provided scope dependencies; 
+    all the dependencies that we include in only one of the 
+    runtime-specific-WARs are in provided scope -->
+    <skip-third-party-bom>false</skip-third-party-bom>
+    <third-party-bom-scopes>compile|provided</third-party-bom-scopes>
+  </properties>
 
   <dependencies>
     <dependency>
@@ -25,20 +34,6 @@
       <scope>provided</scope>
     </dependency>
 
-    <!-- dependencies only used for assemblies should be scope provided -->
-    <dependency>
-      <groupId>org.camunda.bpm</groupId>
-      <artifactId>camunda-engine</artifactId>
-      <scope>provided</scope>
-    </dependency>
-
-    <!-- dependencies only used for assemblies should be scope provided -->
-    <dependency>
-      <groupId>org.camunda.commons</groupId>
-      <artifactId>camunda-commons-logging</artifactId>
-      <scope>provided</scope>
-    </dependency>
-
     <!-- dependencies only used for assemblies should be scope provided -->
     <dependency>
       <groupId>org.camunda.bpm</groupId>