Jetty.project: Add a BOM artifact

[victornoel]

Hi,

There exists unofficial BOMs for Jetty (such as https://github.com/jirutka/jetty-bom or https://github.com/anthavio/anthavio-maven-poms/blob/master/jetty9-bom.pom), but it would be even better if Jetty was providing its own.

The problem is that they always are a bit behind releases from Jetty, and it would make sense for releasing it as part of a normal Jetty release :)

Thanks!

[joakime]

There's no valid way to make a single "Bill of Materials" (BOM) for Jetty that all projects can use equally.

The philosophy behind Jetty is that it is modular.
There are many components that are optional (even the Server component!)
As well as many other components that have multiple different (conflicting) implementations to choose from.

Having a single "all of jetty" doesn't exist.
Even the much argued "default jetty" doesn't exist either.

[victornoel]

@joakime maybe we are not talking about the same definition of BOM.

I'm talking about a pom that can be imported in the dependency management of a project so that a user can be sure that all ITS (those he choose) jetty dependency are of the same version.

The objective is NOT to depends on all Jetty, but to depends on the compatible jetty artifact.

You use something like this as follows:

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>cz.jirutka.maven</groupId>
        <artifactId>jetty-bom</artifactId>
        <version>9.3.15.v20161220</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

And then in you are sure that your dependencies (or your dependencies dependencies) have the same version of jetty.

[victornoel]

@joakime have you seen my answer and do you think we could reopen this issue if we are clear on the usage of a BOM with Maven?
Thanks :)

[joakime]

Your BOM proposal, and the existing (deprecated in Jetty 10.x) jetty-all artifact are the same.

https://dev.eclipse.org/mhonarc/lists/jetty-users/msg06030.html

Your BOM proposal addresses a tiny subset of users, but opens up the rest to faulty expectations about jetty and maven.

You have not adequately convinced the 3 Apache Maven members on this project that the BOM proposal is a good general purpose idea.

[victornoel]

@joakime again I think we are talking about two different things.

I am not advocating for something like jetty-all at all.

If you compare jetty-all.pom with jetty-bom.pom, you will see that the first one declares dependencies while the second declares dependencyManagement.

This is completely different and has completely different purposes.
This use case is a very common one and is answered by many projects, see for example:

• Jersey: http://search.maven.org/#search%7Cga%7C1%7Cjersey-bom
• dropwizard: http://search.maven.org/#search%7Cga%7C1%7Cdropwizard-bom
• jackson: http://search.maven.org/#search%7Cga%7C1%7Cjackson-bom
• and many others.

See also https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html for a detailed explanation of the concept (search for bom in the page).

Hope this helps!

[jmcc0nn3ll]

if we are going to add this in then I think we ought to make use of it throughout the jetty build for managing the versions of all jetty runtime dependencies

it is sort of analogous to the whole eclipse IP log concept and in that way we would be well served to have a jetty-bom artifact that effectively tied to the versions of dependencies declared in the iplog...everything in one place version declaration wise

[victornoel]

@jmcc0nn3ll just one comment: there is two different requirements:

• proposing a BOM for users of Jetty so that they can enforce a specific version in their project, even for its dependencies dependencies
• organising the build of jetty to have one place where dependencies versions are organised.

I'm just interested in the first one, so jetty-bom would be one of the produced jetty artefacts, and it would only contain a dependencyManagement section with all jetty's artefacts (or at least those that are meant to be used via maven dependencies, see @joakime comment on https://github.com/jirutka/jetty-bom/issues/3#issuecomment-281679458 which contains details on what is or isn't meant to be used from maven, if I understood right).
Optionally, this bom could contain versioning for some of the dependencies of jetty when it's important for a project using jetty to have the right one (for example it could contain the servlet api version).

[jmcc0nn3ll]

sure, a jetty-bom artifact could have all produced jetty artifacts and their established 'eclipse ip process cleared' dependencies (asm, jsp, cdi, etc) declared in a single dependencyManagement section

[edit] then anyone that slurps in the bom file gets what ought to work version wise, and then can use normal maven process to exclude and/or replace dependency versions

[victornoel]

Would be great :)

[jhaeyaert]

Definitely a really good idea !

[olamy]

sounds good idea. @joakime if you're not working on it feel free to assign it to me.

[andrei-ivanov]

Any plans for getting this into a release? :)

[joakime]

Should show up for Jetty 9.4.5 (this week?)

[joakime]

@andrei-ivanov and @victornoel know that jetty-bom is causing lots of extra headache/work and is in threat of being removed because of it. See #1527 for more details.

[victornoel]

@joakime thanks :)

[andrei-ivanov]

Added a comment there, thanks :)