When the spring-boot-maven-plugin performs the repackage goal the POM order of the libraries is not maintained

[marioja]

When this maven issue was fixed in maven 2.0.9 the java.util.LinkedHashSet was used instead of the java.util.HashSet. When the spring-boot-maven-plugin performs the repackage goal using the AbstractDependencyFilterMojo.filterDependencies method the org.apache.maven.shared.artifact.filter.collection.FilterArtifacts.filter method will be called and will try to apply all of the filters in its filters ArrayList fields. In my particular case, the ArrayList contained 4 entries which were:

1. org.springframework.boot.maven.ExcludeFilter
2. org.apache.maven.shared.artifact.filter.collection.ScopeFilter
3. org.apache.maven.shared.artifact.filter.collection.ArtifactIdFilter
4. org.springframework.boot.maven.MatchingGroupIdFilter

They are all using HashSet instead of LinkedHashSet. This breaks the POM order for libraries and should be fixed. It looks like two are in the Spring Boot maven plugin which should be easy to fix but the others would require maven source changes. I do not know what other filters could be used over and above the 4 were in my case but they would also need to be changed.

Fixing this bug will give users some control of the classpath ordering when launching a jar file.

[marioja]

Any update when this could be triaged? Thanks

[philwebb]

One option might be to do the filtering on a new set, then use that to remove items from the original set.

[marioja]

Are you commenting on how to fix it or how to work around?

[philwebb]

Just a note to myself or whoever picks it up that we might be able to fix it without changing those Maven plugins. We'll need to change the code for sure, I can't see a way to work around the issue without that.

[snicoll]

@marioja this is going to be available in the next 1.5.2.BUILD-SNAPSHOT. If you can give it a try and report back that would be great!

[marioja]

What are the maven coordinates to get that build snapshot? Mario On Mar 1, 2017, at 07:21, Stéphane Nicoll <notifications@github.com<mailto:notifications@github.com>> wrote: @marioja<https://github.com/marioja> this is going to be available in the next 1.5.2.BUILD-SNAPSHOT. If you can give it a try and report back that would be great! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#8397 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AAC_rIrrpYiFmx9jqP6sJIZpkjw-px7Oks5rhWKagaJpZM4MKxmb>.

[snicoll]

I am not following. Just use Spring Boot 1.5.2.BUILD-SNAPSHOT instead of 1.5.1.RELEASE. You can create a project on start.spring.io if you don't know how to get the bits. But wait that the build completes first (we've had a glitch on the 1.5.x branch this morning so the snapshot hasn't been updated yet).

[marioja]

My bad, what I meant was do I get this snapshot from Maven Central or do I need special POM configuration to get this snapshot? How do I know when and if the snapshot ran?

[marioja]

Ok, a little of Googling told me that the snapshot repository lives at this location. Is there a fail proof way of discovering this? In my POM, I specify the snapshot repository in the distribution management section but I could not find it in the Spring Boot pom.

[snicoll]

@marioja I already replied you and http://projects.spring.io/spring-boot/ has more info. If you're still confused, please join us on gitter and let's chat there rather than adding noise here.