I am using iText 2.1.7 for a JAR in my application. Naturally, including this JAR in my app creates a transitive dependency on iText. That in turn creates a transitive dependency on three Bouncy Castle JARs. The tree looks like:
+--- My Jar | +--- org.apache.logging.log4j:log4j-core:2.4 | | \--- org.apache.logging.log4j:log4j-api:2.4 | +--- com.lowagie:itext:2.1.7 | | +--- bouncycastle:bcmail-jdk14:138 | | +--- bouncycastle:bcprov-jdk14:138 | | \--- bouncycastle:bctsp-jdk14:138 | | \--- org.bouncycastle:bctsp-jdk14:1.38 | | +--- org.bouncycastle:bcprov-jdk14:1.38 | | \--- org.bouncycastle:bcmail-jdk14:1.38 | | \--- org.bouncycastle:bcprov-jdk14:1.38
You see that somewhere there was a confusion numbering the *-jdk14 JARs. When the application WAR is built, I get two copies of each JAR. The are identical except for the version number:
$ jar tvf build/libs/myapp.war | grep jdk14 192035 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bcmail-jdk14-138.jar 1551468 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bcprov-jdk14-138.jar 22994 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bctsp-jdk14-138.jar 22994 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bctsp-jdk14-1.38.jar 1551468 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bcprov-jdk14-1.38.jar 192035 Tue Mar 17 09:14:32 EDT 2015 WEB-INF/lib/bcmail-jdk14-1.38.jar
This does no harm but it is irritating.
Using Gradle 2.12 I have successfully excluded other transitive dependencies in my app, but this one won’t go away. I have tried excluding in compile, but this errors if I try including a version as in
exclude group: x, module: y, version: z and ignores
exclude module: x:y:z. I have also tried excluding the JARs in WAR target with
exclude("WEB-INF/lib/bcprov-jdk14-138.jar"). Neither works.
I have also tried
applicationDistribution.exclude("**/*-jdk14-138.jar") based on a suggestion when I created this topic. It does not work either.
What is a solution?