I am using iText 2.1.7 for a JAR in my application. Naturally, including this JAR in my app creates a transitive dependency on iText. That in turn creates a transitive dependency on three Bouncy Castle JARs. The tree looks like:
+--- My Jar
| +--- org.apache.logging.log4j:log4j-core:2.4
| | \--- org.apache.logging.log4j:log4j-api:2.4
| +--- com.lowagie:itext:2.1.7
| | +--- bouncycastle:bcmail-jdk14:138
| | +--- bouncycastle:bcprov-jdk14:138
| | \--- bouncycastle:bctsp-jdk14:138
| | \--- org.bouncycastle:bctsp-jdk14:1.38
| | +--- org.bouncycastle:bcprov-jdk14:1.38
| | \--- org.bouncycastle:bcmail-jdk14:1.38
| | \--- org.bouncycastle:bcprov-jdk14:1.38
You see that somewhere there was a confusion numbering the *-jdk14 JARs. When the application WAR is built, I get two copies of each JAR. The are identical except for the version number:
$ jar tvf build/libs/myapp.war | grep jdk14
192035 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bcmail-jdk14-138.jar
1551468 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bcprov-jdk14-138.jar
22994 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bctsp-jdk14-138.jar
22994 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bctsp-jdk14-1.38.jar
1551468 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bcprov-jdk14-1.38.jar
192035 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bcmail-jdk14-1.38.jar
This does no harm but it is irritating.
Using Gradle 2.12 I have successfully excluded other transitive dependencies in my app, but this one won’t go away. I have tried excluding in compile, but this errors if I try including a version as in exclude group: x, module: y, version: z and ignores exclude module: x:y:z. I have also tried excluding the JARs in WAR target with exclude("**/WEB-INF/lib/bcprov-jdk14-138.jar") and exclude("WEB-INF/lib/bcprov-jdk14-138.jar"). Neither works.
I have also tried applicationDistribution.exclude("**/*-jdk14-138.jar") based on a suggestion when I created this topic. It does not work either.
What is a solution?