Browse Source

Forbid guava group instead of artifact name (#83546)

We disallow including guava on the compile classpaths, but currently
this only forbids the main guava artifact. Yet there are other artifacts
(eg failureaccess) provided by guava. This commit changes the dependency
check to use the guava group instead of artifact name.
Ryan Ernst 3 years ago
parent
commit
dae889b3e5

+ 5 - 6
build-tools-internal/src/main/groovy/elasticsearch.forbidden-dependencies.gradle

@@ -8,16 +8,15 @@
 
 // we do not want any of these dependencies on the compilation classpath
 // because they could then be used within Elasticsearch
-List<String> FORBIDDEN_DEPENDENCIES = [
-  'guava'
+List<String> FORBIDDEN_DEPENDENCY_GROUPS = [
+  'com.google.guava'
 ]
 
 Closure checkDeps = { Configuration configuration ->
   configuration.resolutionStrategy.eachDependency {
-    String artifactName = it.target.name
-    if (FORBIDDEN_DEPENDENCIES.contains(artifactName)) {
-      throw new GradleException("Dependency '${artifactName}' on configuration '${configuration.name}' is not allowed. " +
-        "If it is needed as a transitive depenency, try adding it to the runtime classpath")
+    if (FORBIDDEN_DEPENDENCY_GROUPS.contains(it.target.group)) {
+      throw new GradleException("Dependency '${it.target.group}:${it.target.name}' on configuration '${configuration.name}' is not allowed. " +
+        "If it is needed as a transitive dependency, try adding it to the runtime classpath")
     }
   }
 }

+ 1 - 1
modules/repository-gcs/build.gradle

@@ -30,7 +30,7 @@ dependencies {
   api 'com.google.cloud:google-cloud-core:1.95.4'
   api 'com.google.cloud:google-cloud-core-http:1.95.4'
   runtimeOnly 'com.google.guava:guava:30.1.1-jre'
-  api 'com.google.guava:failureaccess:1.0.1'
+  runtimeOnly 'com.google.guava:failureaccess:1.0.1'
   api "commons-logging:commons-logging:${versions.commonslogging}"
   api "org.apache.logging.log4j:log4j-1.2-api:${versions.log4j}"
   api "commons-codec:commons-codec:${versions.commonscodec}"