[MASSEMBLY-940] moduleSet - incorrect binary dependencies added to assembly

**[Nigel Jones](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=jonesn)** opened **[MASSEMBLY-940](https://issues.apache.org/jira/browse/MASSEMBLY-940?redirect=false)** and commented

In moduleSet, dependencies are not based on specific modules included:

I have a large multimodule project (https://github.com/odpi/egeria) which has over 300 modules, mostly java (->jar).

One of our submodules is responsible for creating the composite assembly. Previously we were doing it 'the wrong way' (IMO) with lots of relative paths (../../.. etc) and I've recently been trying to switch to using moduleSets, and follow best practices for assembly. We were also previously doing lots of building 'jar with dependencies' but this doesn't scale as every possibly useful for ends up far too big...

I have hit a problem with dependencies and moduleSets

We have a series of 'client' artifacts. These have some dependencies (for example we use restclient from spring, jackson etc). One section of my assembly attempts to package the clients into a folder, and include any dependencies they may need:

\
\
\true\
\
\org.odpi.egeria:asset-catalog-client:*\
\org.odpi.egeria:asset-consumer-client:*\
\org.odpi.egeria:asset-owner-client:*\
\org.odpi.egeria:community-profile-client:*\
\org.odpi.egeria:data-engine-client:*\
\org.odpi.egeria:it-infrastructure-client:*\
\org.odpi.egeria:it-infrastructure-client:*\
\org.odpi.egeria:data-manager-client:*\
\org.odpi.egeria:data-privacy-client:*\
\org.odpi.egeria:data-science-client:*\
\org.odpi.egeria:dev-ops-client:*\
\org.odpi.egeria:digital-architecture-client:*\
\org.odpi.egeria:discovery-engine-client:*\
\org.odpi.egeria:governance-engine-client:*\
\org.odpi.egeria:governance-program-client:*\
\org.odpi.egeria:information-view-client:*\
\org.odpi.egeria:project-management-client:*\
\org.odpi.egeria:security-officer-client:*\
\org.odpi.egeria:software-developer-client:*\
\org.odpi.egeria:stewardship-action-client:*\
\org.odpi.egeria:subject-area-client:*\
\org.odpi.egeria:admin-services-client:*\
\org.odpi.egeria:project-management-client:*\
\
\
\./clients\
\false\
\true\
\

We have a similar pattern for utilities, samples, connectors etc.

I had thought 'includeDependencies' would JUST pull in dependencies for the modules listed in the included. However I seem to get every dependency for the entire project (reactor)

I then tried:

\false\
\
\

instead, with the same result.

Then switched to this -- since the pom for the module doing the assembly DOES have a lot of dependencies (in fact it needs to be everything the assembly refers to as a module, so that we ensure those modules are built first - and exist) - so thinking (but unsure) if useProjectArtifact was relevant:

\false\
\
\true\
\false\
\false\
\

but yet again this still pulls in all dependencies.

The results are inconsistent with 'mvn dependency:tree' - and in fact whatever is built I just always seem to get the same. It's not transitively based off every module in the reactor, but seems to be based of the pom of the project containing the assembly.

Shouldn't I just be pulling in dependencies of the binaries I specify in the moduleSet?

I've read the definitive maven book chapter, and the docs, but I can't quite figure out what I'm missing here.

To clarify as well, here's another example

\
\
\true\
\
\org.odpi.egeria:open-metadata-conformance-suite-client:*\
\
\
\./conformance-suite\
\false\
\false\
\
\
\true\
\false\
\false\
\
\
\
\

Again, I get the same dependencies - this time into ./conformance-suite yet that is just a single module I am putting into that dir - and I can simply show

[INFO] --- maven-dependency-plugin:3.1.2:tree (default-cli) @ open-metadata-conformance-suite-client ---
[INFO] org.odpi.egeria:open-metadata-conformance-suite-client:jar:2.1-SNAPSHOT
[INFO] +- org.odpi.egeria:open-metadata-conformance-suite-api:jar:2.1-SNAPSHOT:compile
[INFO] | +- org.slf4j:slf4j-api:jar:1.7.30:compile
[INFO] | \- com.fasterxml.jackson.core:jackson-annotations:jar:2.11.1:compile
[INFO] +- org.odpi.egeria:rest-client-connectors-api:jar:2.1-SNAPSHOT:compile
[INFO] | \- org.odpi.egeria:open-connector-framework:jar:2.1-SNAPSHOT:compile
[INFO] | \- org.odpi.egeria:audit-log-framework:jar:2.1-SNAPSHOT:compile
[INFO] +- org.odpi.egeria:rest-client-factory:jar:2.1-SNAPSHOT:compile
[INFO] | \- org.odpi.egeria:spring-rest-client-connector:jar:2.1-SNAPSHOT:compile
[INFO] | +- org.springframework:spring-web:jar:5.2.7.RELEASE:compile
[INFO] | | \- org.springframework:spring-beans:jar:5.2.7.RELEASE:compile
[INFO] | +- org.codehaus.plexus:plexus-utils:jar:3.3.0:compile
[INFO] | \- org.springframework:spring-core:jar:5.2.7.RELEASE:compile
[INFO] | \- org.springframework:spring-jcl:jar:5.2.7.RELEASE:compile
[INFO] +- commons-io:commons-io:jar:2.7:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.11.1:compile
[INFO] | \- com.fasterxml.jackson.core:jackson-core:jar:2.11.1:compile
[INFO] +- ch.qos.logback:logback-classic:jar:1.2.3:compile
[INFO] | \- ch.qos.logback:logback-core:jar:1.2.3:compile
[INFO] \- org.slf4j:slf4j-simple:jar:1.7.30:test

not so bad, yet deposited into that directory is my usual set of 462 or so jars..

---

**Affects:** 3.3.0

1 votes, 4 watchers

Start by tracing the moduleSet and binaries handling for includeDependencies and dependencySets, then compare the selected module's dependency tree with the assembly output. Reproduce the reported case using the conformance-suite-client example and verify that the output contains dependencies for only the included module rather than the assembly project's broader dependency set.

Written by the indexing model from the issue text.