[MASSEMBLY-1008] Fix transitive dependencies resolving with required scope

pom.xml

@@ -108,10 +108,9 @@ under the License.
     </dependency>
     <dependency>
       <groupId>org.eclipse.aether</groupId>
-      <artifactId>aether-api</artifactId>
+      <artifactId>aether-util</artifactId>
       <!-- the same version as in Maven 3.2.5 -->
       <version>1.0.0.v20140518</version>
-      <scope>provided</scope>
     </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>

src/it/projects/dependency-sets/massembly-1008/pom.xml

@@ -0,0 +1,71 @@
+<?xml version="1.0"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.apache.maven.plugin.assembly.test</groupId>
+        <artifactId>it-project-parent</artifactId>
+        <version>1</version>
+    </parent>
+
+    <groupId>test</groupId>
+    <artifactId>massembly-1008</artifactId>
+    <version>1</version>
+
+    <url>https://issues.apache.org/jira/browse/MASSEMBLY-1008</url>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    </properties>
+    <dependencies>
+        <dependency>
+            <groupId>com.google.inject</groupId>
+            <artifactId>guice</artifactId>
+            <version>6.0.0</version>
+        </dependency>
+        <dependency>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+            <version>31.0.1-jre</version>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
+            <plugin>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>assembly</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                        <configuration>
+                            <descriptors>
+                                <descriptor>src/main/assembly/bin.xml</descriptor>
+                            </descriptors>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+</project>

src/it/projects/dependency-sets/massembly-1008/src/main/assembly/bin.xml

@@ -0,0 +1,33 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<assembly>
+  <id>bin</id>
+  <formats>
+    <format>dir</format>
+  </formats>
+  <includeBaseDirectory>false</includeBaseDirectory>
+  <dependencySets>
+    <dependencySet>
+      <unpack>false</unpack>
+      <scope>runtime</scope>
+      <outputDirectory></outputDirectory>
+      <useProjectArtifact>false</useProjectArtifact>
+    </dependencySet>
+  </dependencySets>
+</assembly>

src/it/projects/dependency-sets/massembly-1008/verify.groovy

@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import java.io.*;
+
+def expectedFilenames = [
+        "aopalliance-1.0.jar",
+        "checker-qual-3.12.0.jar",
+        "error_prone_annotations-2.7.1.jar",
+        "failureaccess-1.0.1.jar",
+        "guava-31.0.1-jre.jar",
+        "guice-6.0.0.jar",
+        "j2objc-annotations-1.3.jar",
+        "jakarta.inject-api-2.0.1.jar",
+        "javax.inject-1.jar",
+        "jsr305-3.0.2.jar",
+        "listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar"
+]
+
+File assemblyBasedir = new File( basedir, "target/massembly-1008-1-bin/" )
+
+assert assemblyBasedir.listFiles().length == expectedFilenames.size()
+
+for ( fileName in expectedFilenames )
+{
+  File file = new File( assemblyBasedir, fileName )
+  assert file.isFile() // exists and is file
+}
+
+// defined set vs listed set: same cardinality and all present: OK
+
+return true

src/main/java/org/apache/maven/plugins/assembly/artifact/DefaultDependencyResolver.java

@@ -22,15 +22,24 @@
 import javax.inject.Named;
 import javax.inject.Singleton;
 
+import java.util.ArrayDeque;
+import java.util.ArrayList;
+import java.util.Deque;
+import java.util.HashMap;
+import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
+import java.util.stream.Collectors;
 
+import org.apache.maven.RepositoryUtils;
 import org.apache.maven.artifact.Artifact;
 import org.apache.maven.artifact.DefaultArtifact;
 import org.apache.maven.artifact.handler.manager.ArtifactHandlerManager;
 import org.apache.maven.artifact.versioning.VersionRange;
+import org.apache.maven.model.DependencyManagement;
 import org.apache.maven.plugins.assembly.AssemblerConfigurationSource;
 import org.apache.maven.plugins.assembly.archive.ArchiveCreationException;
 import org.apache.maven.plugins.assembly.archive.phase.ModuleSetAssemblyPhase;
@@ -40,14 +49,24 @@
 import org.apache.maven.plugins.assembly.model.ModuleSet;
 import org.apache.maven.project.MavenProject;
 import org.codehaus.plexus.util.StringUtils;
+import org.eclipse.aether.RepositorySystem;
+import org.eclipse.aether.RepositorySystemSession;
+import org.eclipse.aether.collection.CollectRequest;
+import org.eclipse.aether.graph.DefaultDependencyNode;
+import org.eclipse.aether.graph.Dependency;
+import org.eclipse.aether.graph.DependencyFilter;
+import org.eclipse.aether.graph.DependencyNode;
+import org.eclipse.aether.graph.DependencyVisitor;
+import org.eclipse.aether.resolution.DependencyRequest;
+import org.eclipse.aether.resolution.DependencyResult;
+import org.eclipse.aether.util.filter.DependencyFilterUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import static java.util.Objects.requireNonNull;
 
 /**
  * @author jdcasey
- *
  */
 @Singleton
 @Named
@@ -56,9 +75,12 @@ public class DefaultDependencyResolver implements DependencyResolver {
 
     private final ArtifactHandlerManager artifactHandlerManager;
 
+    private final RepositorySystem repositorySystem;
+
     @Inject
-    public DefaultDependencyResolver(ArtifactHandlerManager artifactHandlerManager) {
+    public DefaultDependencyResolver(ArtifactHandlerManager artifactHandlerManager, RepositorySystem repositorySystem) {
         this.artifactHandlerManager = requireNonNull(artifactHandlerManager);
+        this.repositorySystem = requireNonNull(repositorySystem);
     }
 
     @Override
@@ -75,7 +97,8 @@ public Map<DependencySet, Set<Artifact>> resolveDependencySets(
             final MavenProject currentProject = configSource.getProject();
 
             final ResolutionManagementInfo info = new ResolutionManagementInfo();
-            updateDependencySetResolutionRequirements(dependencySet, info, currentProject);
+            updateDependencySetResolutionRequirements(
+                    configSource.getMavenSession().getRepositorySession(), dependencySet, info, currentProject);
             updateModuleSetResolutionRequirements(moduleSet, dependencySet, info, configSource);
 
             result.put(dependencySet, info.getArtifacts());
@@ -96,7 +119,8 @@ public Map<DependencySet, Set<Artifact>> resolveDependencySets(
             final MavenProject currentProject = configSource.getProject();
 
             final ResolutionManagementInfo info = new ResolutionManagementInfo();
-            updateDependencySetResolutionRequirements(dependencySet, info, currentProject);
+            updateDependencySetResolutionRequirements(
+                    configSource.getMavenSession().getRepositorySession(), dependencySet, info, currentProject);
 
             result.put(dependencySet, info.getArtifacts());
         }
@@ -127,7 +151,10 @@ void updateModuleSetResolutionRequirements(
 
             if (binaries.isIncludeDependencies()) {
                 updateDependencySetResolutionRequirements(
-                        dependencySet, requirements, projects.toArray(new MavenProject[0]));
+                        configSource.getMavenSession().getRepositorySession(),
+                        dependencySet,
+                        requirements,
+                        projects.toArray(new MavenProject[0]));
             }
         }
     }
@@ -149,7 +176,10 @@ private Artifact createArtifact(String groupId, String artifactId, String versio
     }
 
     void updateDependencySetResolutionRequirements(
-            final DependencySet set, final ResolutionManagementInfo requirements, final MavenProject... projects)
+            RepositorySystemSession systemSession,
+            final DependencySet set,
+            final ResolutionManagementInfo requirements,
+            final MavenProject... projects)
             throws DependencyResolutionException {
         for (final MavenProject project : projects) {
             if (project == null) {
@@ -158,14 +188,91 @@ void updateDependencySetResolutionRequirements(
 
             Set<Artifact> dependencyArtifacts = null;
             if (set.isUseTransitiveDependencies()) {
-                dependencyArtifacts = project.getArtifacts();
+                try {
+                    // we need resolve project again according to requested scope
+                    dependencyArtifacts = resolveTransitive(systemSession, set.getScope(), project);
+                } catch (org.eclipse.aether.resolution.DependencyResolutionException e) {
+                    throw new DependencyResolutionException(e.getMessage(), e);
+                }
             } else {
+                // FIXME remove using deprecated method
                 dependencyArtifacts = project.getDependencyArtifacts();
             }
 
             requirements.addArtifacts(dependencyArtifacts);
-            LOGGER.debug("Dependencies for project: " + project.getId() + " are:\n"
-                    + StringUtils.join(dependencyArtifacts.iterator(), "\n"));
+            if (LOGGER.isDebugEnabled()) {
+                LOGGER.debug(
+                        "Dependencies for project: {} are:\n{}",
+                        project.getId(),
+                        StringUtils.join(dependencyArtifacts.iterator(), "\n"));
+            }
         }
     }
+
+    private Set<Artifact> resolveTransitive(
+            RepositorySystemSession repositorySession, String scope, MavenProject project)
+            throws org.eclipse.aether.resolution.DependencyResolutionException {
+
+        // scope dependency filter
+        DependencyFilter scoopeDependencyFilter = DependencyFilterUtils.classpathFilter(scope);
+
+        // get project dependencies filtered by requested scope
+        List<Dependency> dependencies = project.getDependencies().stream()
+                .map(d -> RepositoryUtils.toDependency(d, repositorySession.getArtifactTypeRegistry()))
+                .filter(d -> scoopeDependencyFilter.accept(new DefaultDependencyNode(d), null))
+                .collect(Collectors.toList());
+
+        List<Dependency> managedDependencies = Optional.ofNullable(project.getDependencyManagement())
+                .map(DependencyManagement::getDependencies)
+                .map(list -> list.stream()
+                        .map(d -> RepositoryUtils.toDependency(d, repositorySession.getArtifactTypeRegistry()))
+                        .collect(Collectors.toList()))
+                .orElse(null);
+
+        CollectRequest collectRequest = new CollectRequest();
+        collectRequest.setManagedDependencies(managedDependencies);
+        collectRequest.setRepositories(project.getRemoteProjectRepositories());
+        collectRequest.setDependencies(dependencies);
+        collectRequest.setRootArtifact(RepositoryUtils.toArtifact(project.getArtifact()));
+
+        DependencyRequest request = new DependencyRequest(collectRequest, scoopeDependencyFilter);
+
+        DependencyResult dependencyResult = repositorySystem.resolveDependencies(repositorySession, request);
+
+        // cache for artifact mapping
+        Map<org.eclipse.aether.artifact.Artifact, Artifact> aetherToMavenArtifacts = new HashMap<>();
+        Deque<String> stack = new ArrayDeque<>();
+        stack.push(project.getArtifact().getId());
+
+        Set<Artifact> artifacts = new HashSet<>();
+
+        // we need rebuild artifact dependencyTrail - it is used by useTransitiveFiltering
+        dependencyResult.getRoot().accept(new DependencyVisitor() {
+            @Override
+            public boolean visitEnter(DependencyNode node) {
+                if (node.getDependency() != null) {
+                    stack.push(aetherToMavenArtifacts
+                            .computeIfAbsent(node.getDependency().getArtifact(), RepositoryUtils::toArtifact)
+                            .getId());
+                }
+                return true;
+            }
+
+            @Override
+            public boolean visitLeave(DependencyNode node) {
+                if (node.getDependency() != null) {
+                    Artifact artifact = aetherToMavenArtifacts.computeIfAbsent(
+                            node.getDependency().getArtifact(), RepositoryUtils::toArtifact);
+                    List<String> depTrail = new ArrayList<>();
+                    stack.descendingIterator().forEachRemaining(depTrail::add);
+                    stack.pop();
+                    artifact.setDependencyTrail(depTrail);
+                    artifacts.add(artifact);
+                }
+                return true;
+            }
+        });
+
+        return artifacts;
+    }
 }