basepom / duplicate-finder-maven-plugin

Maven plugin to find duplicate classes or resources

duplicate-finder Maven plugin

A maven plugin to find and flag duplicate classes and resources on the java classpath.

This ensures stability and reproducability of a maven build and will flag possible problems or conflicts with dependencies in a project.

About

This plugin is a friendly fork (same main authors) of the Ning maven-duplicate-finder plugin. It is configuration compatible to the ning plugin; the only change required is the group and artifact id of the plugin itself.

Requirements

The plugins requires Apache Maven 3.x.x.

Starting with release 1.2.0, Java 7 or better is required.

Starting with release 1.3.0, Java 8 or better is required.

Starting with release 1.5.0, Java 8 or better is required to run the plugin and Java 9 or better (Java 11 strongly recommended) is required to build the plugin.

Goals

The plugin has two goals:

• duplicate-finder:check - the main goal of the plugin. Runs duplicate check on the maven classpaths.
• duplicate-finder:help - displays standard maven plugin help information.

Documentation

Up-to-date documentation is available from the documentation site.

Release Notes

See the Changelog.

Authors

• Thomas Dudziak (@tomdz)
• Henning Schmiedehausen (@hgschmie)

Contributors

• Andrew Gaul (@andrewgaul)
• Davy De Waele (@ddewaele)
• Conny Kreyßel (@kreyssel)
• Matt Stephenson (@mattstep)
• Mickaël Tricot (@mickaeltr)
• Steven Schlansker (@stevenschlansker)
• Tim Williamson (@twilliamson)
• @camshoff
• @jakub-bochenski
• Michael Bellomo (@mbellomo)
• Frank Jakop (fjakop)
• Brian Clozel (@bclozel)

duplicate-finder-maven-plugin's Issues

Update guava version

Could you please update the guava version? The current version 2.0.1 of the duplicate-finder-maven-plugin is dependent on com.google.guava:guava version 31.1-jre which has two vulnerabilities. See https://mvnrepository.com/artifact/org.basepom.maven/duplicate-finder-maven-plugin/2.0.1

post JDK 8 work

• fully support multi-release jars (see comment in #33)
• take a stab at supporting the module path
• remove all the boot classpath magic
• change build to use JDK11 (later 14) and compile down to probably JDK 9 compatibility

Potential security vulnerability with a dependency: CVE-2017-1000487.

In a security review of our implementation we found that there is an open CVE for the version of plexus-utils that is being used.

Find modules/classpath duplicates for JDK11

There is a very common issue with Eclipse and duplicated packages from classpaths and the module of JDK11: https://stackoverflow.com/questions/55571046/eclipse-is-confused-by-imports-accessible-from-more-than-one-module
However, this plugin did not find any collisions.
It would be really helpful if this plugin would include the JDK11 dependencies which will be added by default to find such collisions, so I can exclude dependencies from dependencies to fix this issue!

Detect duplicate packages

See ning/maven-duplicate-finder-plugin#15

Display dependency paths of conflicting artifacts

It would be a nice feature if once a duplicate is found, the transitive path to the artifact was displayed as well in the console and/or the report. Right now you have to rely on separate plugins (maven-dependency-plugin with obscure parameters to filter irrelevant dependencies or crazy greping) to understand why a conflicting artifact is there in the first place

I'm not sure about the formatting since the line might be super long then, but maybe something like

  [WARNING] Found duplicate and different classes in [a -> b -> c -> com.google.api.grpc:proto-google-cloud-logging-v2:0.81.0, d -> e -> f -> com.google.api.grpc:proto-google-common-protos:1.16.0]:

If not, just a new log line with the path to each artifact

Exception thrown for classes where package name directory contains '.'

An exception (like the one shown below) is thrown if duplicates are found in a jar file's class which contains a dot in one of the directories composing the package name. For example, if my jar file is jaxb-osgi-2.2.5-2.jar
and my duplicated class is 1.0.org.apache.xml.resolver.tools.ResolvingXMLFilter
then I will get the exception shown below, because the resource name in the jar file is actually
1.0/org/apache/xml/resolver/tools/ResolvingXMLFilter.class
instead of
1/0/org/apache/xml/resolver/tools/ResolvingXMLFilter.class
like the code is written to look for (having earlier done a global search and replace of '.' with '/').

[WARNING] Could not read content from file /Users/foxdk/.m2/repository/com/sun/xml/bind/jaxb-osgi/2.2.5-2/jaxb-osgi-2.2.5-2.jar!
java.io.IOException: Could not find 1/0/org/apache/xml/resolver/tools/ResolvingXMLFilter.class in archive /Users/foxdk/.m2/repository/com/sun/xml/bind/jaxb-osgi/2.2.5-2/jaxb-osgi-2.2.5-2.jar
at org.basepom.mojo.duplicatefinder.DuplicateFinderMojo.getSHA256HexOfElement(DuplicateFinderMojo.java:606)
at org.basepom.mojo.duplicatefinder.DuplicateFinderMojo.determineConflictState(DuplicateFinderMojo.java:554)
at org.basepom.mojo.duplicatefinder.DuplicateFinderMojo.checkForDuplicates(DuplicateFinderMojo.java:536)
at org.basepom.mojo.duplicatefinder.DuplicateFinderMojo.checkClasspath(DuplicateFinderMojo.java:490)
at org.basepom.mojo.duplicatefinder.DuplicateFinderMojo.execute(DuplicateFinderMojo.java:379)

Does the plugin work with Kotlin?

I have a Kotlin class where I have multiple methods with the same name but different arguments in a single kotlin file (not class). The plugin says its having duplicates but actually not exists

Include Boot Classpath seems not working

I have a project configured like this

<dependencies>
	<dependency>
		<groupId>jdbc</groupId>
		<artifactId>jdbc-stdext</artifactId>
		<version>2.0</version>
	</dependency>
</dependencies>

<build>
	<plugins>
		<plugin>
			<groupId>org.basepom.maven</groupId>
			<artifactId>duplicate-finder-maven-plugin</artifactId>
			<version>1.2.1</version>
			<executions>
				<execution>
					<id>default</id>
					<phase>validate</phase>
					<goals>
						<goal>check</goal>
					</goals>
				</execution>
			</executions>
			<configuration>
				<includeBootClasspath>true</includeBootClasspath>
			</configuration>
		</plugin>
	</plugins>
</build>

and the dependency jdbc-stdext contains a very old version of javax.sql.DataSource.

When I run mvn validate with JDK 8 there is no error shown, the output is just

[INFO] --- duplicate-finder-maven-plugin:1.2.1:check (default) @ my-project ---
[INFO] Checking compile classpath
[INFO] Checking runtime classpath
[INFO] Checking test classpath
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS

I think according to the docs this should at leas bring up an error for javax.sql.DataSource or did I miss something?

doesn't seem to work with mvnd

related apache/maven-mvnd#559

Exclusion patterns are ignored during a multi module reactor build

In one project I have:

                <artifactId>maven-jar-plugin</artifactId>
                <executions>
                    <execution>
                        <id>default-test-jar</id>
                        <configuration>
                            <excludes>
                                <exclude>**/applicationContext.xml</exclude>
                            </excludes>
                        </configuration>
                    </execution>

Then when:

• I use the tests jar in another project,
• both projects are build in the same run (multi module build)
• the other project also has an applicationContext.xml file in it's test resources directory

I get the following reported:

  [WARNING] Found duplicate and different resources in [/home/jenkins/workspace/Acme_Job/acme/module/common_pod/build/testClasses, com.acme:common_platform:0.0.1-SNAPSHOT:jar:tests]:
  [WARNING] applicationContext.xml

Note: I did double-check that the tests-jar does NOT have the applicationContext.xml
When I build the projects separately, and not in the same reactor, the warning does NOT appear.

Unable to find dependency for this plugin

Do I need to add any repo/group in settings.xml?

<groupId>org.basepom.maven</groupId>
                        <artifactId>duplicate-finder-maven-plugin</artifactId>
                        <version>1.3.0</version>

Wiki: Description of option 'failBuildInCaseOfConflict' wrong?

Hi,

sorry to open an issue for that, but I could not figure out how to contact you guys.

I think the description of the option 'failBuildInCaseOfConflict' might be wrong/misleading as it is the same text as for the option 'failBuildInCaseOfDifferentContentConflict':
'Fail the build if any class or resource on the classpath is duplicate and their SHA256 hash is different.'

Shouldn't it read something like this?
'Fail the build if any class or resource on the classpath is duplicate regardless of the SHA256 hash values.'

See:
https://github.com/basepom/duplicate-finder-maven-plugin/wiki/Simple%20Options

Cheers
Patrick

Bug with "No repo reference" with a plugin dependency

Hi,

I have a project in a multi-module set-up that is used only as a dependency to a plugin declared in the parent pom of other projects in this multi-module set-up (it's a project containing enforcer rules used by the other projects).
This module is deployed on a repository (ow2 snapshots) declared in my settings.xml.

When I try to run the check goal of duplicate-finder-maven-plugin I get the following error:

[ERROR] Failed to execute goal org.basepom.maven:duplicate-finder-maven-plugin:1.1.0:check (check-duplicates) on project petals-commons-log: Execution check-duplicates of goal org.basepom.maven:duplicate-finder-maven-plugin:1.1.0:check failed: Found project reference to org.ow2.petals:petals-enforcer-rules:jar:1.0.4-SNAPSHOT but no repo reference! -> [Help 1]

I don't think it is normal, and moreover I don't see why it should look for it in a repository since it is part of the reactor build!

Thanks!

Ignore Java 9's module-info classes by default

It is easy to configure this plugin to ignore duplicate module-info.class classes with the following:

<configuration>
  <ignoredClassPatterns>
    <ignoredClassPattern>module-info</ignoredClassPattern>
  </ignoredClassPatterns>
</configuration>

Since those classes might be quite common in the future, shouldn't this be ignored by default?
Otherwise, those are marked as duplicate classes with different content.

Can I check classes with the same class name in one project?

I expect failure when there are two classes with same name App in project.

   target/classes/com/mycompany/app/App.class
   target/classes/com/mycompany/app2/App.class

my-app-banDuplicateClasses.tar.gz

pom.xml

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.mycompany.app</groupId>
  <artifactId>my-app</artifactId>
  <version>1.0-SNAPSHOT</version>

  <name>my-app</name>
  <!-- FIXME change it to the project's website -->
  <url>http://www.example.com</url>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <maven.compiler.source>1.7</maven.compiler.source>
    <maven.compiler.target>1.7</maven.compiler.target>
  </properties>

  <dependencies>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <version>4.11</version>
      <scope>test</scope>
    </dependency>
  </dependencies>

  <build>
    <plugins>
        <plugin>
            <groupId>org.basepom.maven</groupId>
            <artifactId>duplicate-finder-maven-plugin</artifactId>
            <version>1.5.1</version>
            <executions>
                <execution>
                    <id>default</id>
                    <phase>verify</phase>
                    <goals>
                        <goal>check</goal>
                    </goals>
                </execution>
            </executions>

<configuration>
    <skip>false</skip>
    <quiet>false</quiet>
    <checkCompileClasspath>true</checkCompileClasspath>
    <checkRuntimeClasspath>true</checkRuntimeClasspath>
    <checkTestClasspath>true</checkTestClasspath>
    <failBuildInCaseOfDifferentContentConflict>false</failBuildInCaseOfDifferentContentConflict>
    <failBuildInCaseOfEqualContentConflict>false</failBuildInCaseOfEqualContentConflict>
    <failBuildInCaseOfConflict>false</failBuildInCaseOfConflict>
    <printEqualFiles>false</printEqualFiles>
    <preferLocal>true</preferLocal>

    <!-- Version 1.1.1+ -->
    <includeBootClasspath>false</includeBootClasspath>
    <bootClasspathProperty>sun.boot.class.path</bootClasspathProperty>
    <!-- Version 1.1.1+ -->


    <!-- Version 1.2.0+ -->
    <includePomProjects>false</includePomProjects>
    <!-- Version 1.2.0+ -->
</configuration>

        </plugin>
 </plugins>
  </build>
</project>

find target/classes

target/classes
target/classes/com
target/classes/com/mycompany
target/classes/com/mycompany/app
target/classes/com/mycompany/app/App.class
target/classes/com/mycompany/app/App1.class
target/classes/com/mycompany/app2
target/classes/com/mycompany/app2/App2.class
target/classes/com/mycompany/app2/App.class

mvn -X clean compile -DskipTests verify

[INFO] --- duplicate-finder-maven-plugin:1.5.1:check (default) @ my-app ---
[DEBUG] Dependency collection stats: {ConflictMarker.analyzeTime=101007, ConflictMarker.markTime=91454, ConflictMarker.nodeCount=72, ConflictIdSorter.graphTime=39531, ConflictIdSorter.topsortTime=32313, ConflictIdSorter.conflictIdCount=33, ConflictIdSorter.conflictIdCycleCount=0, ConflictResolver.totalTime=1151037, ConflictResolver.conflictItemCount=65, DefaultDependencyCollector.collectTime=103022165, DefaultDependencyCollector.transformTime=1443280}
[DEBUG] org.basepom.maven:duplicate-finder-maven-plugin:jar:1.5.1
[DEBUG]    org.apache.maven:maven-plugin-api:jar:3.0:compile
[DEBUG]    org.apache.maven:maven-model:jar:3.0:compile
[DEBUG]       org.codehaus.plexus:plexus-utils:jar:2.0.4:compile
[DEBUG]    org.apache.maven:maven-artifact:jar:3.0:compile
[DEBUG]    org.apache.maven:maven-core:jar:3.0:compile
[DEBUG]       org.apache.maven:maven-settings:jar:3.0:compile
[DEBUG]       org.apache.maven:maven-settings-builder:jar:3.0:compile
[DEBUG]       org.apache.maven:maven-repository-metadata:jar:3.0:compile
[DEBUG]       org.apache.maven:maven-model-builder:jar:3.0:compile
[DEBUG]       org.apache.maven:maven-aether-provider:jar:3.0:runtime
[DEBUG]       org.sonatype.aether:aether-impl:jar:1.7:compile
[DEBUG]          org.sonatype.aether:aether-spi:jar:1.7:compile
[DEBUG]       org.sonatype.aether:aether-api:jar:1.7:compile
[DEBUG]       org.sonatype.aether:aether-util:jar:1.7:compile
[DEBUG]       org.codehaus.plexus:plexus-interpolation:jar:1.14:compile
[DEBUG]       org.codehaus.plexus:plexus-classworlds:jar:2.2.3:compile
[DEBUG]       org.codehaus.plexus:plexus-component-annotations:jar:1.5.5:compile
[DEBUG]       org.sonatype.plexus:plexus-sec-dispatcher:jar:1.3:compile
[DEBUG]          org.sonatype.plexus:plexus-cipher:jar:1.4:compile
[DEBUG]    com.google.guava:guava:jar:28.1-jre:compile
[DEBUG]       com.google.guava:failureaccess:jar:1.0.1:compile
[DEBUG]       com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[DEBUG]       org.checkerframework:checker-qual:jar:2.8.1:compile
[DEBUG]       com.google.errorprone:error_prone_annotations:jar:2.3.2:compile
[DEBUG]       com.google.j2objc:j2objc-annotations:jar:1.3:compile
[DEBUG]       org.codehaus.mojo:animal-sniffer-annotations:jar:1.18:compile
[DEBUG]    net.jcip:jcip-annotations:jar:1.0:compile
[DEBUG]    com.google.code.findbugs:jsr305:jar:3.0.2:compile
[DEBUG]    org.slf4j:slf4j-api:jar:1.7.28:compile
[DEBUG]    org.codehaus.woodstox:stax2-api:jar:3.1.4:compile
[DEBUG]    org.codehaus.woodstox:woodstox-core-asl:jar:4.4.1:runtime
[DEBUG]    com.fasterxml.staxmate:staxmate:jar:2.2.1:compile
[DEBUG] Created new class realm plugin>org.basepom.maven:duplicate-finder-maven-plugin:1.5.1
[DEBUG] Importing foreign packages into class realm plugin>org.basepom.maven:duplicate-finder-maven-plugin:1.5.1
[DEBUG]   Imported:  < maven.api
[DEBUG] Populating class realm plugin>org.basepom.maven:duplicate-finder-maven-plugin:1.5.1
[DEBUG]   Included: org.basepom.maven:duplicate-finder-maven-plugin:jar:1.5.1
[DEBUG]   Included: org.codehaus.plexus:plexus-utils:jar:2.0.4
[DEBUG]   Included: org.sonatype.aether:aether-util:jar:1.7
[DEBUG]   Included: org.codehaus.plexus:plexus-interpolation:jar:1.14
[DEBUG]   Included: org.codehaus.plexus:plexus-component-annotations:jar:1.5.5
[DEBUG]   Included: org.sonatype.plexus:plexus-sec-dispatcher:jar:1.3
[DEBUG]   Included: org.sonatype.plexus:plexus-cipher:jar:1.4
[DEBUG]   Included: com.google.guava:guava:jar:28.1-jre
[DEBUG]   Included: com.google.guava:failureaccess:jar:1.0.1
[DEBUG]   Included: com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava
[DEBUG]   Included: org.checkerframework:checker-qual:jar:2.8.1
[DEBUG]   Included: com.google.errorprone:error_prone_annotations:jar:2.3.2
[DEBUG]   Included: com.google.j2objc:j2objc-annotations:jar:1.3
[DEBUG]   Included: org.codehaus.mojo:animal-sniffer-annotations:jar:1.18
[DEBUG]   Included: net.jcip:jcip-annotations:jar:1.0
[DEBUG]   Included: com.google.code.findbugs:jsr305:jar:3.0.2
[DEBUG]   Included: org.codehaus.woodstox:stax2-api:jar:3.1.4
[DEBUG]   Included: org.codehaus.woodstox:woodstox-core-asl:jar:4.4.1
[DEBUG]   Included: com.fasterxml.staxmate:staxmate:jar:2.2.1
[DEBUG] Configuring mojo org.basepom.maven:duplicate-finder-maven-plugin:1.5.1:check from plugin realm ClassRealm[plugin>org.basepom.maven:duplicate-finder-maven-plugin:1.5.1, parent: sun.misc.Launcher$AppClassLoader@4e25154f]
[DEBUG] Configuring mojo 'org.basepom.maven:duplicate-finder-maven-plugin:1.5.1:check' with basic configurator -->
[DEBUG]   (f) bootClasspathProperty = sun.boot.class.path
[DEBUG]   (f) checkCompileClasspath = true
[DEBUG]   (f) checkRuntimeClasspath = true
[DEBUG]   (f) checkTestClasspath = true
[DEBUG]   (f) failBuildInCaseOfConflict = false
[DEBUG]   (f) failBuildInCaseOfDifferentContentConflict = false
[DEBUG]   (f) failBuildInCaseOfEqualContentConflict = false
[DEBUG]   (f) includeBootClasspath = false
[DEBUG]   (f) includePomProjects = false
[DEBUG]   (f) preferLocal = true
[DEBUG]   (f) printEqualFiles = false
[DEBUG]   (f) project = MavenProject: com.mycompany.app:my-app:1.0-SNAPSHOT @ /Users/rock/work/code/cc/my-app/pom.xml
[DEBUG]   (f) quiet = false
[DEBUG]   (f) resultFile = /Users/rock/work/code/cc/my-app/target/duplicate-finder-result.xml
[DEBUG]   (f) resultFileMinClasspathCount = 2
[DEBUG]   (f) skip = false
[DEBUG]   (f) useDefaultClassIgnoreList = true
[DEBUG]   (f) useDefaultResourceIgnoreList = true
[DEBUG]   (f) useResultFile = true
[DEBUG] -- end configuration --
[INFO] Checking compile classpath
[INFO] Checking runtime classpath
[DEBUG] Cache hit for '/Users/rock/work/code/cc/my-app/target/classes'
[INFO] Checking test classpath
[DEBUG] Ignoring META-INF/MANIFEST.MF, MANIFEST.MF is not a class file
[DEBUG] Ignoring LICENSE.txt, LICENSE.txt is not a class file
[DEBUG] Ignoring 'META-INF/MANIFEST.MF' (matches ^META-INF/.*)
[DEBUG] Ignoring 'LICENSE.txt' (matches .*license(\.txt)?$)
[DEBUG] Ignoring 'junit.extensions.ActiveTestSuite$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'junit.extensions.TestSetup$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'junit.extensions.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring 'junit.framework.JUnit4TestAdapterCache$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'junit.framework.TestResult$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'junit.framework.TestSuite$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'junit.framework.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring 'junit.runner.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring 'junit.textui.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring 'org.junit.ComparisonFailure$ComparisonCompactor' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.Test$None' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.ParallelComputer$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.categories.Categories$CategoryFilter' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.categories.Categories$ExcludeCategory' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.categories.Categories$IncludeCategory' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.max.MaxCore$1$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.max.MaxCore$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.max.MaxHistory$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.max.MaxHistory$RememberingListener' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.max.MaxHistory$TestComparator' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.results.ResultMatchers$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.results.ResultMatchers$2' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.results.ResultMatchers$3' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.theories.PotentialAssignment$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.theories.PotentialAssignment$CouldNotGenerateValueException' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.theories.Theories$TheoryAnchor$1$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.theories.Theories$TheoryAnchor$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.theories.Theories$TheoryAnchor$2' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.theories.Theories$TheoryAnchor' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.theories.internal.AllMembersSupplier$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.experimental.theories.internal.AllMembersSupplier$MethodParameterValue' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.internal.MethodSorter$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.internal.MethodSorter$2' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.internal.requests.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring 'org.junit.internal.runners.JUnit38ClassRunner$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.internal.runners.JUnit38ClassRunner$OldTestClassAdaptingListener' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.internal.runners.JUnit4ClassRunner$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.internal.runners.JUnit4ClassRunner$2' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.internal.runners.MethodRoadie$1$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.internal.runners.MethodRoadie$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.internal.runners.MethodRoadie$2' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.internal.runners.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring 'org.junit.internal.runners.statements.FailOnTimeout$StatementThread' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.matchers.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring 'org.junit.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring 'org.junit.rules.ErrorCollector$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.rules.ExpectedException$ExpectedExceptionStatement' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.rules.ExternalResource$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.rules.TestWatcher$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.rules.TestWatchman$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.rules.Verifier$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.Computer$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.Request$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.Result$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.Result$Listener' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.manipulation.Filter$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.manipulation.Filter$2' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.manipulation.Filter$3' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.manipulation.Sorter$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.manipulation.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring 'org.junit.runner.notification.RunNotifier$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.notification.RunNotifier$2' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.notification.RunNotifier$3' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.notification.RunNotifier$4' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.notification.RunNotifier$5' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.notification.RunNotifier$6' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.notification.RunNotifier$7' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.notification.RunNotifier$SafeNotifier' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runner.notification.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring 'org.junit.runner.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring 'org.junit.runners.BlockJUnit4ClassRunner$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runners.Parameterized$Parameter' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runners.Parameterized$Parameters' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runners.Parameterized$TestClassRunnerForParameters' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runners.ParentRunner$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runners.ParentRunner$2' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runners.ParentRunner$3' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runners.ParentRunner$4' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runners.Suite$SuiteClasses' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runners.model.FrameworkMethod$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.junit.runners.package-info' (matches ^(.*\.)?package-info$)
[DEBUG] Ignoring META-INF/MANIFEST.MF, MANIFEST.MF is not a class file
[DEBUG] Ignoring LICENSE.txt, LICENSE.txt is not a class file
[DEBUG] Ignoring 'META-INF/MANIFEST.MF' (matches ^META-INF/.*)
[DEBUG] Ignoring 'LICENSE.txt' (matches .*license(\.txt)?$)
[DEBUG] Ignoring 'org.hamcrest.Condition$1' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.hamcrest.Condition$Matched' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.hamcrest.Condition$NotMatched' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.hamcrest.Condition$Step' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.hamcrest.Description$NullDescription' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.hamcrest.core.CombinableMatcher$CombinableBothMatcher' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Ignoring 'org.hamcrest.core.CombinableMatcher$CombinableEitherMatcher' (matches ^(.*\.)?.*\$.*$)
[DEBUG] Cache hit for '/Users/rock/work/code/cc/my-app/target/classes'
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  2.208 s
[INFO] Finished at: 2022-01-26T13:21:10+08:00
[INFO] ------------------------------------------------------------------------

SonarQube integration

Is it possible to integrate the plug-in into the popular static analyzing tool (SonarQube)?
It would be really great to see the results there

Allow specifying only groupId for conflictingDependencies

This is useful for things like the io.fabric8 client which has a dozen dependencies all with the same conflicting resources.

Replace/remove slf4j-log4j12

We have automated tools to scan for and flag log4j 1.x. The rationale for the scan is that 1.x was EOL a while ago. I can't speak to the validity of that premise, and maybe I could fight that battle in my organization, but I figured it would be worth asking if this plugin can depend on a newer or different logging framework.

create a facility to limit the class scope of the plugin

Limit the set of classes on which the plugin acts.

externalize exceptions

With the number of exceptions steadily growing, it would be good to externalize them (similar to other plugins) to be able to put them into a policy jar.

See spotbugs for multiple files,

Project will not build without JAVA7_HOME environment variable set

This project will not build without JAVA7_HOME environment variable set. That's not a very common environment variable to be set. JAVA_HOME is reasonable, but variations of this seems unusual.

duplicate finder plugin should respect the toolchains when doing bootclasspath checks

Currently, when executing under the toolchains plugin, the duplicate finder will check against the JDK providing the bootclasspath setting. This is the JDK executing maven, not the jdk used to build the code. This is a known limitation and working around is not easy as the toolchain JDK does not expose the boot classpath (except through an obscure -X command line property which is only supported in Java 7 and Java 8).

Finer-grained ignore patterns

Often duplicates exist between two JARs and those duplicates need to be ignored, but it is not desirable to ignore either JAR entirely. We just want to ignore their mutual dependencies, while still catching other duplications (for example, a third JAR that introduces unwanted duplicates between it and the two JARs with allowed duplicates).

In our homegrown duplicate finder, we can define JAR-to-JAR whitelisted pairs, and also class-to-JAR whitelisted pairs.

For example:

Whitelisted JAR pairs:
jre/lib/rt.jar:
----rt/lib/endorsed/webservices-api-2.0.1.jar
----rt/tomcat/lib/tomcat-annotations-api-7.0.39.jar
----rt/tomcat/shared/lib/webservices-extra-2.0.1.jar
----rt/tomcat/shared/lib/webservices-rt-2.0.1.jar
rt/lib/endorsed/webservices-api-2.0.1.jar:
----jre/lib/rt.jar
rt/tomcat/lib/tomcat-annotations-api-7.0.39.jar:
----jre/lib/rt.jar
----rt/tomcat/shared/lib/webservices-extra-2.0.1.jar

Whitelisted class/JAR pairs:
com.intuit.ims.shared.enums.ImsOffering:
----rt/lib/ims-shared-1.0.14-SNAPSHOT.jar
----rt/lib/ipsaccount-3.2.0-rel-0.jar
javax.transaction.TransactionRequiredException:
----jre/lib/rt.jar
----rt/lib/jboss-transaction-api-1.0.1.GA.jar
javax.transaction.TransactionRolledbackException:
----jre/lib/rt.jar
----rt/lib/jboss-transaction-api-1.0.1.GA.jar
org.aspectj.internal.lang.reflect.StringToType:
----rt/lib/aspectjrt-1.7.4.jar
----rt/lib/aspectjtools-1.8.4.jar
----rt/lib/aspectjweaver-1.8.4.jar
org.bouncycastle.jcajce.DefaultJcaJceHelper:
----rt/lib/bcmail-jdk16-1.46.jar
----rt/lib/bcprov-jdk15on-1.49.jar

We want to replace our homegrown duplicate finder with duplicate-finder-maven-plugin, but don't want to give up the fine-grained ignore controls.

Ignore /META-INF/versions/9/module-info.class by default

We have the same issue with /META-INF/versions/9/module-info.clas files as in #31.
e.g. https://travis-ci.org/zalando/logbook/jobs/448681344 or #31 comment

conflictState="content-different"

can't configure exceptions to show on the report only
duplicate that answer true to => conflictState="content-different"

Allow validation for projects with POM packaging

When building EAR files, we usually do not use EAR packaging, but a packaging of POM and configure various plugins to build the deployment files. Nevertheless, we'd like to run duplicate-finder plugin at this point, because it's at the end of the build chain.

Unfortunately, the plugin does not work on such projects, issuing a message:
Ignoring POM project!

This was not the case for maven-duplicate-finder-plugin. Please find a way to run the plugin on POM style projects, too -- for instance by forcing it with some config option.

Potential security vulnerability with a dependency: CVE-2018-10237.

In a security review of our implementation we found that guava has an open CVE on the version that is being used in this plugin.

Provide reporting target

The output of this plugin often gets lost in the other noise of the maven build. Since maven provides a nice facility for reporting (aka. maven site), it would be nice if this plugin could be used to generate a simple report inside the site execution.

Check goal fails if the same dependency is inculded twice

I'm getting the following error, my guess is that because the project includes both

    <dependency>
        <groupId>com.acme.filestore</groupId>
        <artifactId>common</artifactId>
        <version>${project.version}</version>
    </dependency>

and

    <dependency>
        <groupId>com.acme.filestore</groupId>
        <artifactId>common</artifactId>
        <version>${project.version}</version>
        <classifier>tests</classifier>
        <scope>test</scope>
    </dependency>

and

            <dependency>
                <groupId>com.acme.filestore</groupId>
                <artifactId>common</artifactId>
                <version>${project.version}</version>
                <classifier>tomcat</classifier>
                <type>tgz</type>
            </dependency>

[ERROR] Failed to execute goal org.basepom.maven:duplicate-finder-maven-plugin:1.1.1:check (default) on project psmgr: Execution default of goal org.basepom.maven:duplicate-finder-maven-plugin:1.1.1:check failed: value already present: /home/acme/gotham/trunk/java/common/target/classes -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.basepom.maven:duplicate-finder-maven-plugin:1.1.1:check (default) on project psmgr: Execution default of goal org.basepom.maven:duplicate-finder-maven-plugin:1.1.1:check failed: value already present: /home/acme/gotham/trunk/java/common/target/classes
        at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:224)
        at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:153)
        at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:145)
        at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:108)
        at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:76)
        at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build(SingleThreadedBuilder.java:51)
        at org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:116)
        at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:361)
        at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:155)
        at org.apache.maven.cli.MavenCli.execute(MavenCli.java:584)
        at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:213)
        at org.apache.maven.cli.MavenCli.main(MavenCli.java:157)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:606)
        at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:289)
        at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:229)
        at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:415)
        at org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:356)
Caused by: org.apache.maven.plugin.PluginExecutionException: Execution default of goal org.basepom.maven:duplicate-finder-maven-plugin:1.1.1:check failed: value already present: /home/acme/gotham/trunk/java/common/target/classes
        at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:144)
        at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:208)
        ... 19 more
Caused by: java.lang.IllegalArgumentException: value already present: /home/acme/gotham/trunk/java/common/target/classes
        at com.google.common.collect.HashBiMap.put(HashBiMap.java:238)
        at com.google.common.collect.HashBiMap.put(HashBiMap.java:215)
        at org.basepom.mojo.duplicatefinder.artifact.ArtifactFileResolver.<init>(ArtifactFileResolver.java:102)
        at org.basepom.mojo.duplicatefinder.DuplicateFinderMojo.execute(DuplicateFinderMojo.java:339)
        at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:133)
        ... 20 more

java.lang.IllegalArgumentException: value already present

I just hit an issue with two dependencies that try to declare jdk tools jar as a dependency. Both do it a bit differently because they use different coordinates: one (org.jolokia:jolokia-jvm:jar:agent:1.5.0) -- com.sun:tools:1.8, and the other (org.neo4j:neo4j-dbms:3.4.11) -- jdk.tools:jdk.tools:1.6. As you probably imagine, they're both scope=system deps with systemPath=${java.home}/../lib/tools.jar.

In the above described environment plugin execution fails with:

java.lang.IllegalArgumentException: value already present: /Library/Java/JavaVirtualMachines/jdk1.8.0_181.jdk/Contents/Home/jre/../lib/tools.jar
	at com.google.common.collect.HashBiMap.put(HashBiMap.java:238)
	at com.google.common.collect.HashBiMap.put(HashBiMap.java:215)
	at org.basepom.mojo.duplicatefinder.artifact.ArtifactFileResolver.<init>(ArtifactFileResolver.java:91)
	at org.basepom.mojo.duplicatefinder.DuplicateFinderMojo.execute(DuplicateFinderMojo.java:362)
	at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:101)
	... 20 more

Check goal fails if same dependency included twice without packaging jars

I get a similar error message to #10, but I am running version 1.2.1, and the error only happens when compiling modules, not when packaging them as jars.

• p1 generates a default jar and a sources jar
• p2 has both p1 and p1:sources as a dependency.

Invoke this way:

mvn clean compile org.basepom.maven:duplicate-finder-maven-plugin:1.2.1:check

Error:

org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.basepom.maven:duplicate-finder-maven-plugin:1.2.1:check (default-cli) on project test-issue-99-p2: Execution default-cli of goal org.basepom.maven:duplicate-finder-maven-plugin:1.2.1:check failed: value already present: /home/sflaniga/NotBackedUp/src/duplicate-finder-maven-plugin/src/it/test-issue-99/p1/target/classes
        at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:212)
        at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:153)
        at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:145)
        at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:116)
        at io.takari.maven.builder.smart.SmartBuilderImpl.buildProject(SmartBuilderImpl.java:334)
        at io.takari.maven.builder.smart.SmartBuilderImpl$ProjectBuildTask.run(SmartBuilderImpl.java:104)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.apache.maven.plugin.PluginExecutionException: Execution default-cli of goal org.basepom.maven:duplicate-finder-maven-plugin:1.2.1:check failed: value already present: /home/sflaniga/NotBackedUp/src/duplicate-finder-maven-plugin/src/it/test-issue-99/p1/target/classes
        at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:145)
        at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:207)
        ... 10 more
Caused by: java.lang.IllegalArgumentException: value already present: /home/sflaniga/NotBackedUp/src/duplicate-finder-maven-plugin/src/it/test-issue-99/p1/target/classes
        at com.google.common.collect.HashBiMap.put(HashBiMap.java:238)
        at com.google.common.collect.HashBiMap.put(HashBiMap.java:215)
        at org.basepom.mojo.duplicatefinder.artifact.ArtifactFileResolver.<init>(ArtifactFileResolver.java:91)
        at org.basepom.mojo.duplicatefinder.DuplicateFinderMojo.execute(DuplicateFinderMojo.java:362)
        at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:134)
        ... 11 more

Similar errors can be seen with shaded jars.

I don't see the problem when using:

mvn clean package org.basepom.maven:duplicate-finder-maven-plugin:1.2.1:check

Sample project:

test-issue-99.zip