Re: [sisu-dev] are asm, cdi-api and jsr250-api required

[Stuart McCulloch <mcculls@xxxxxxxxx>]

On 8 Sep 2013, at 17:09, Igor Fedorenko wrote:

> I am working on updating m2e to use 3.1.x version of maven and I noticed
> that susi brings in some new dependencies. Before I waste any of my time
> on CQs, can somebody confirm that the following dependencies are indeed
> required to use sisu in the context of Maven?
> 
> * asm-3.3.1.jar

Needed in M2a while we got permission to embed ASM, but not required since M3 (see https://bugs.eclipse.org/bugs/show_bug.cgi?id=406612)

> * cdi-api-1.0.jar

Optional dependency that provides the @Typed annotation - AFAIK no Maven components use this feature yet, but they may do in the future

> * jsr250-api-1.0.jar

Optional dependency that provides @PostConstruct and @PreDestroy annotations - not used at the moment, but will be supported in the future

> As a side note, looks like sisu indirectly references
> com.google.code.findbugs:jsr305:1.3.9, which Eclipse IP team did not
> like [1]. To make it easier to consume sisu without accidentally getting
> LGPL-ed dependencies, it may make sense to exclude jsr305.
> 
> [1] https://dev.eclipse.org/ipzilla/show_bug.cgi?id=7302

Ugh, the JSR305 jar distributed with findbugs has its own license file (new BSD) separate to the findbugs license that matches the original source:  

   http://code.google.com/p/findbugs/source/browse/branches/1.3.9/findbugs/LICENSE-jsr305.txt

but the POM on Central only mentions ASL2 which muddies the waters: http://code.google.com/p/jsr-305/issues/detail?id=13

This is an optional indirect dependency of Sisu-Plexus (specifically Sisu-Plexus --> Sisu-Guice --> Guava --> JSR305) so this will be addressed by:

   https://bugs.eclipse.org/bugs/show_bug.cgi?id=416841

Summary: you don't need cdi-api, jsr250-api, or jsr305 to run Maven ... asm is only required by M2a of Sisu, if you use M3 or later it's not needed

> --
> Regards,
> Igor