apache / apache/netbeans

mavenutilities: nbm:manifest should be configurable to ignore certain verification failures

Open
#5,457 0 comments 0 reactions 0 assignees View on GitHub
kind:feature needs:triage Platform
Dominant language
Java
Stars
3.1k
Forks
935
Avg merge
2d 3h
Merged PRs (30d)
17

Description

### Description

(I hope this is the correct issue tracker for the _mavenutilities_ project as well; https://github.com/apache/netbeans-mavenutils-nbm-maven-plugin/#reporting-bugs still points to the Apache Jira which points here)

There should be a way to exclude certain classes from NetBeans dependency verification. ATM, all one can do is to set `` from `fail` to `warn` (or, worse, to `skip`).

As an improvement, one can imagine some kind of ``/`` configuration option for ignorable packages.

Alternatively, and more of a hacky workaround, `nbm:manfifest` might include `provided`-scoped dependencies in the dependency-verification step but (still) not bundle them in the NBM.

This workaround would at least cover the case of optional, transitive dependencies that are actually unused by the NetBeans plug-in (see **Use case/motivation** below for a specific example).

### Use case/motivation

The `nbm-maven-plugin:4.8:manifest` goal currently fails the build if an **optional** dependency is not present in `compile` scope.

```
[INFO] --- nbm-maven-plugin:4.8:manifest (default-manifest) @ com.example.plugin ---
[INFO] NBM Plugin generates manifest
[INFO] Adding on module's Class-Path:
...
[INFO] org.apache.commons:commons-compress:jar:1.22

[ERROR] Failed to execute goal org.apache.netbeans.utilities:nbm-maven-plugin:4.8:manifest (default-manifest) on project com.example.plugin: Uncategorized problems with NetBeans dependency verification (maybe MNBMODULE-102 or wrong maven dependency metadata). Supposedly external classes are used in the project's binaries but the classes are not found on classpath. Class usages: [org.objectweb.asm.Opcodes, org.objectweb.asm.Label, org.objectweb.asm.ClassReader, org.objectweb.asm.AnnotationVisitor, org.objectweb.asm.ClassVisitor, org.objectweb.asm.FieldVisitor, org.objectweb.asm.Type, org.objectweb.asm.MethodVisitor, org.objectweb.asm.Attribute] -> [Help 1]
```

Now, [`commons-compress`](https://search.maven.org/artifact/org.apache.commons/commons-compress/1.22/jar) has, among other things, an optional dependency on ASM and that is only used for pack200 (de)compression.

```xml


org.ow2.asm
asm
${asm.version}
true

```

As my plugin doesn't use that particular feature, I don't want to bloat my plug-in by including ASM.

Note that this particular issue _sometimes_ doesn't occur when building against newer versions of NetBeans, which expose ASM via `org-netbeans-modules-settings`:

```
[INFO] +- org.netbeans.api:org-netbeans-modules-settings:jar:RELEASE160:compile
[INFO] | +- org.netbeans.modules:org-netbeans-bootstrap:jar:RELEASE160:runtime
[INFO] | \- org.netbeans.modules:org-netbeans-core-startup:jar:RELEASE160:runtime
[INFO] | +- org.netbeans.api:org-netbeans-libs-asm:jar:RELEASE160:runtime
[INFO] | | +- org.ow2.asm:asm:jar:9.3:runtime
[INFO] | | +- org.ow2.asm:asm-tree:jar:9.3:runtime
[INFO] | | \- org.ow2.asm:asm-commons:jar:9.3:runtime
[INFO] | | \- org.ow2.asm:asm-analysis:jar:9.3:runtime
[INFO] | \- org.netbeans.modules:org-netbeans-core-startup-base:jar:RELEASE160:runtime
```

But the main point still stands: There should be _some_ way to ignore optional transitive dependencies during NetBeans dependency verification.

### Related issues

_No response_

### Are you willing to submit a pull request?

Maybe (depending on the implementation complexity of the solution)

### Code of Conduct

Yes

Contributor guide

Open the contributing guide

Research direction

Start with the nbm:manifest goal and its verifyRuntime behavior described in the issue, then trace the NetBeans dependency-verification step. Compare the proposed includes/excludes configuration with the provided-scope workaround. Done means optional, unused transitive dependencies can be ignored without bundling them, while genuine verification failures remain detectable.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.