Dependencies are not exposed to maven central causing build failure

[GMishx]

Hello there,

At SW360, we are using org.spdx:tools-java:2.0.0 from maven central. However, I cannot see any dependency defined in project's pom.xml on central: https://central.sonatype.com/artifact/org.spdx/tools-java/2.0.0/dependencies

This causes our test cases to fail due to missing classes of various stores. Can you please help us with it?

java.lang.NoClassDefFoundError: org/spdx/spdxRdfStore/RdfStore
	at org.spdx.tools.SpdxToolsHelper.fileTypeToStore(SpdxToolsHelper.java:100)
	at org.spdx.tools.SpdxToolsHelper.deserializeDocumentCompatV2(SpdxToolsHelper.java:211)
	at org.eclipse.sw360.spdx.SpdxBOMImporter.openAsSpdx(SpdxBOMImporter.java:134)

If I add org.spdx:spdx-rdf-store:2.0.0 as dependency of my pom.xml, Java start complaining about java.lang.NoClassDefFoundError: org/spdx/v3jsonldstore/JsonLDStore

Link to PR: eclipse-sw360/sw360#3095

Failing test cases: https://github.com/eclipse-sw360/sw360/actions/runs/14570385211/job/40866454627?pr=3095#step:12:912

[bact]

Thank you.
I can see there're changes in dependencies between 2.0.0-Alpha and 2.0.0-RC1.

[bact]

pom.xml in the repo looks fine with dependencies in <dependencies /> section.

[goneall]

From a quick look, the dependency that is reported missing is present in the tools-java POM file:

	  <dependency>
	  	<groupId>org.spdx</groupId>
	  	<artifactId>spdx-rdf-store</artifactId>
	  	<version>2.0.0</version>
	  </dependency>

Note that the unit tests for the tools-java also depend on the spdx-rdf-store and are passing.

I noticed that the POM files in SW360 are referencing both the tools-java and the spdx-java-library - the latter shouldn't be needed since there is a transitive dependency to spdx-java-library. Other than that, I didn't see anything wrong in the PR from a cursory look.

@GMishx - perhaps running mvn test with the debug option -X will shed some light on where the issue is.

[bact]

Thank you. I can see there're changes in dependencies between 2.0.0-Alpha and 2.0.0-RC1.

In the Maven Central pages, I found that the difference are those dependencies in the "COMPILE" scope.

[goneall]

In the Maven Central pages, I found that the difference are those dependencies in the "COMPILE" scope.

Thanks @bact for the pointer - I'll look into this.

[GMishx]

Hey @goneall , I had to add the spdx-java-library as a dependency to my pom.xml as tools-java only reports junit as its dependency and I start getting symbol missing errors:

[ERROR] /home/z003u7px/development/sw360/backend/common/src/main/java/org/eclipse/sw360/datahandler/db/ComponentDatabaseHandler.java:[73,21] package org.spdx.core does not exist
[ERROR] /home/z003u7px/development/sw360/backend/common/src/main/java/org/eclipse/sw360/spdx/SpdxBOMImporter.java:[36,21] package org.spdx.core does not exist
[ERROR] /home/z003u7px/development/sw360/backend/common/src/main/java/org/eclipse/sw360/spdx/SpdxBOMImporter.java:[37,21] package org.spdx.core does not exist
[ERROR] /home/z003u7px/development/sw360/backend/common/src/main/java/org/eclipse/sw360/spdx/SpdxBOMImporter.java:[38,46] package org.spdx.library.model.v2.enumerations does not exist

I am attaching the output of $ mvn clean package -Dbase.deploy.dir=. -DskipTests=true -X -U as requested for you to look at: logs.txt

Even mvn dependency:tree says org.spdx:tools-java:jar:2.0.0:compile has no transitive dependency.

$ mvn dependency:tree
Picked up _JAVA_OPTIONS: -Djdk.net.URLClassPath.disableClassPathURLCheck=true -Djdk.util.zip.disableZip64ExtraFieldValidation=true
[INFO] Scanning for projects...
[INFO] 
[INFO] ------------------< org.eclipse.sw360:backend-common >------------------
[INFO] Building backend-common 19.2.0
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ backend-common ---
[INFO] org.eclipse.sw360:backend-common:jar:19.2.0
[INFO] +- org.eclipse.sw360:backend-service-core:jar:19.2.0:compile
[INFO] +- org.spdx:tools-java:jar:2.0.0:compile
[INFO] +- org.cyclonedx:cyclonedx-core-java:jar:10.2.1:compile
[INFO] |  +- commons-codec:commons-codec:jar:1.18.0:compile
[INFO] |  +- commons-io:commons-io:jar:2.18.0:compile
[INFO] |  +- org.apache.commons:commons-lang3:jar:3.17.0:compile
[INFO] |  +- org.apache.commons:commons-collections4:jar:4.4:compile
[INFO] |  +- com.github.package-url:packageurl-java:jar:1.5.0:compile
[INFO] |  +- com.fasterxml.jackson.dataformat:jackson-dataformat-xml:jar:2.18.3:compile
[INFO] |  |  +- org.codehaus.woodstox:stax2-api:jar:4.2.2:compile
[INFO] |  |  \- com.fasterxml.woodstox:woodstox-core:jar:7.0.0:compile
[INFO] |  \- com.networknt:json-schema-validator:jar:1.5.6:compile
[INFO] |     +- com.ethlo.time:itu:jar:1.10.3:compile
[INFO] |     \- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.18.1:compile
[INFO] |        \- org.yaml:snakeyaml:jar:2.3:compile
..
Chopped for brevity.
..
[INFO] +- org.eclipse.sw360:datahandler:test-jar:tests:19.2.0:test
[INFO] +- org.eclipse.sw360:build-configuration:jar:19.2.0:compile
[INFO] +- org.eclipse.sw360:build-configuration:test-jar:tests:19.2.0:test
[INFO] \- jakarta.mail:jakarta.mail-api:jar:2.0.1:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.579 s
[INFO] Finished at: 2025-04-23T16:47:08+05:30
[INFO] ------------------------------------------------------------------------

[bact]

@goneall I have near zero knowledge about releasing distribution on Maven Central, but which jar will be downloaded with this:

<dependency>
    <groupId>org.spdx</groupId>
    <artifactId>tools-java</artifactId>
    <version>2.0.0</version>
</dependency>

as our build will produce two jars (excluding javadoc.jar), one with dependencies and one without.

Does there a chance this is something to do with shading?

When browsing https://central.sonatype.com/artifact/org.spdx/tools-java/2.0.0/dependencies with "Dependency Type: Indirect" it shows none.

[goneall]

I'm able to duplicate the problem with just a very simple POM file with the tools-java dependency. No indirect dependencies show up.

Removing the Shade plugin solved the problem.

Now the question is "why" and how do we fix it?

The Shade plugin is used to generate the "jar-with-dependencies". I would not expect it to interfere with the actual Jar file.

I'll do a bit more digging.

[goneall]

I verified that this broke in the 2.0.0-RC1 build. The last working build was v1.1.8.

I compare the 2 POM files and experimented with the differences in the Shade file configuration, matching the same values as v1.1.8 and the problem still occurs. Quite a mystery.

[goneall]

I just checked out the tools-java version 1.1.8 and rebuilt it with no modifications. All the dependencies disappeared. So it looks like this is due to some change to Maven and not a change to tools-java.

[bact]

Maybe we take this opportunity to try the nexus-staging-maven-plugin ?

(and also fix this spdx/Spdx-Java-Library#315 ?)

[bact]

But "COMPILE" scope dependencies in libraries like spdx-java-core etc looks fine, hmm.

• https://central.sonatype.com/artifact/org.spdx/spdx-java-core/1.0.0/dependencies
• https://central.sonatype.com/artifact/org.spdx/spdx-rdf-store/2.0.0/dependencies

[goneall]

I think I found the source of the issue - this is an intentional update to the shade plugin - reference: https://issues.apache.org/jira/browse/HIVE-28455

We can fix this by forcing the earlier (working) version of the Shade plugin.

The suggestion is to publish 2 separate artifact IDs, but all our documentation points to generated a jar with dependencies + the shaded jar. I personally disagree with the logic expressed in the referenced issue since we're using Shade to generate a separate JAR file for a different intended use.