[maven-extension] Failure using the Otel Maven extension declared as an <extension> in pom.xml because the pom.xml of the Otel Maven extension lists dependencies even though they are bundled

[cyrille-leclerc]

Description

Failure using the Maven extension declared as a in pom.xml because the pom.xml of the Maven extension lists dependencies even though they are bundled in the opentelemetry-maven-extension jar (which is a uber-jar).

The pom.xml of io.opentelemetry.contrib:opentelemetry-maven-extension:1.6.0-alpha is wrong as it lists as runtime dependencies the OpenTelemetry and GRPC jars that have been integrated in the opentelemetry-maven-extension jar thanks to the Gradle Shadow Plugin.

https://repo1.maven.org/maven2/io/opentelemetry/contrib/opentelemetry-maven-extension/1.6.0-alpha/opentelemetry-maven-extension-1.6.0-alpha.pom

opentelemetry-maven-extension-1.6.0-alpha.pom

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
   <!-- This module was also published with a richer model, Gradle metadata,  -->
   <!-- which should be used instead. Do not delete the following line which  -->
   <!-- is to indicate to Gradle or any Gradle module metadata file consumer  -->
   <!-- that they should prefer consuming it instead. -->
   <!-- do_not_remove: published-with-gradle-metadata -->
   <modelVersion>4.0.0</modelVersion>
   <groupId>io.opentelemetry.contrib</groupId>
   <artifactId>opentelemetry-maven-extension</artifactId>
   <version>1.6.0-alpha</version>
   <name>OpenTelemetry Java Contrib</name>
   <description>Maven extension to observe Maven builds with distributed traces using OpenTelemetry SDK</description>
   <url>https://github.com/open-telemetry/opentelemetry-java-contrib</url>
   <licenses>
      <license>
         <name>The Apache License, Version 2.0</name>
         <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
      </license>
   </licenses>
   <developers>
      <developer>
         <id>opentelemetry</id>
         <name>OpenTelemetry</name>
         <url>https://github.com/open-telemetry/opentelemetry-java-contrib/discussions</url>
      </developer>
   </developers>
   <scm>
      <connection>scm:git:[email protected]:open-telemetry/opentelemetry-java-contrib.git</connection>
      <developerConnection>scm:git:[email protected]:open-telemetry/opentelemetry-java-contrib.git</developerConnection>
      <url>[email protected]:open-telemetry/opentelemetry-java-contrib.git</url>
   </scm>
   <dependencies>
      <dependency>
         <groupId>org.codehaus.plexus</groupId>
         <artifactId>plexus-component-annotations</artifactId>
         <version>2.1.0</version>
         <scope>runtime</scope>
      </dependency>
      <dependency>
         <groupId>io.opentelemetry</groupId>
         <artifactId>opentelemetry-api</artifactId>
         <version>1.6.0</version>
         <scope>runtime</scope>
      </dependency>
      <dependency>
         <groupId>io.opentelemetry</groupId>
         <artifactId>opentelemetry-sdk</artifactId>
         <version>1.6.0</version>
         <scope>runtime</scope>
      </dependency>
      <dependency>
         <groupId>io.opentelemetry</groupId>
         <artifactId>opentelemetry-sdk-trace</artifactId>
         <version>1.6.0</version>
         <scope>runtime</scope>
      </dependency>
      <dependency>
         <groupId>io.opentelemetry</groupId>
         <artifactId>opentelemetry-semconv</artifactId>
         <version>1.6.0-alpha</version>
         <scope>runtime</scope>
      </dependency>
      <dependency>
         <groupId>io.opentelemetry</groupId>
         <artifactId>opentelemetry-exporter-otlp</artifactId>
         <version>1.6.0</version>
         <scope>runtime</scope>
      </dependency>
      <dependency>
         <groupId>io.opentelemetry</groupId>
         <artifactId>opentelemetry-exporter-otlp-trace</artifactId>
         <version>1.6.0</version>
         <scope>runtime</scope>
      </dependency>
      <dependency>
         <groupId>io.grpc</groupId>
         <artifactId>grpc-netty-shaded</artifactId>
         <version>1.39.0</version>
         <scope>runtime</scope>
      </dependency>
   </dependencies>
</project>

Steps to reproduce
Provide a (runnable) recipe for reproducing the error.

• Add the io.opentelemetry.contrib:opentelemetry-maven-extension:1.6.0-alpha extension to a pom.xml (example here)

  <project>
      ...
      <build>
          ...
          <extensions>
              <extension>
                  <groupId>io.opentelemetry.contrib</groupId>
                  <artifactId>opentelemetry-maven-extension</artifactId>
                  <version>1.6.0-alpha</version>
              </extension>
          </extensions>
      </build>
  </project>

• Run you build

  export OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4317"
  mvn verify
  

• We expect the build to succeed but Maven reports a problem of dependencies of the io.opentelemetry.contrib:opentelemetry-maven-extension:jar:1.6.0-alpha extension that should not have any extension

  [INFO] Scanning for projects...
  [ERROR] [ERROR] Some problems were encountered while processing the POMs:
  [ERROR] Unresolveable build extension: Plugin io.opentelemetry.contrib:opentelemetry-maven-extension:1.6.0-alpha or one of its dependencies could not be resolved: Failed to collect dependencies at io.opentelemetry.contrib:opentelemetry-maven-extension:jar:1.6.0-alpha -> io.grpc:grpc-netty-shaded:jar:1.39.0 -> io.grpc:grpc-core:jar:[1.39.0] @
   @
  [ERROR] The build could not read 1 project -> [Help 1]
  [ERROR]
  [ERROR]   The project com.example:demo-parent:0.0.30-SNAPSHOT (/Users/cyrilleleclerc/git/cyrille-leclerc/multi-module-maven-project/pom.xml) has 1 error
  [ERROR]     Unresolveable build extension: Plugin io.opentelemetry.contrib:opentelemetry-maven-extension:1.6.0-alpha or one of its dependencies could not be resolved: Failed to collect dependencies at io.opentelemetry.contrib:opentelemetry-maven-extension:jar:1.6.0-alpha -> io.grpc:grpc-netty-shaded:jar:1.39.0 -> io.grpc:grpc-core:jar:[1.39.0]: No versions available for io.grpc:grpc-core:jar:[1.39.0] within specified range -> [Help 2]
  [ERROR]
  [ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
  [ERROR] Re-run Maven using the -X switch to enable full debug logging.
  [ERROR]
  [ERROR] For more information about the errors and possible solutions, please read the following articles:
  [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException
  [ERROR] [Help 2] http://cwiki.apache.org/confluence/display/MAVEN/PluginManagerException
  

Expectation

The pom.xml of io.opentelemetry.contrib:opentelemetry-maven-extension:jar:1.6.0-alpha should not list any compile or runtime dependency

What applicable config did you use?
N/A

Relevant Environment Information
Version: io.opentelemetry.contrib:opentelemetry-maven-extension:jar:1.6.0-alpha , Maven 3.8.2

Additional context
Add any other context about the problem here.

[cyrille-leclerc]

The problem seems to be the collaboration between the Gradle Shadow Plugin and the Gradle Maven Publish plugin.
We expect the Maven Publish plugin to not add as dependencies in pom.xml the dependencies that have been added to the "uber jar" by the Shadow Plugin.

I didn't find yet a path forward to fix the problem.

---

The cause seems to be related to Gradle Shadow Plugin > Publishing Shadow Jars > Shadow Configuration and Publishing

When configuring publishing with the Shadow plugin, the dependencies in the shadow configuration, are translated to become RUNTIME scoped dependencies of the published artifact.

[cyrille-leclerc]

Fixed by

• Manually remove from pom.xml the dependencies that have been inlined by the shadow plugin #87

@anuraaga @trask could we consider cutting a 1.6.1 release to ship the fix of this bug of the Otel Maven Extension?

[trask]

hey @cyrille-leclerc!

we have an undocumented practice of only patching for regressions, memory leaks and deadlocks (thanks for the reminder tho 😄, documenting that now: https://github.com/open-telemetry/opentelemetry-java-instrumentation/pull/4198/files)

we can always make exceptions, but try to keep those to a minimum

the normal release cadence is monthly, with the Java SDK releasing generally end of the 2nd week of the month, followed "shortly" after by Java Instrumentation and Java Contrib (shortly tends to be a few days to a week)

[cyrille-leclerc]

Thanks for the explanation, it's perfect for me.

[cyrille-leclerc]

Problem fixed in 1.7.0-alpha