From 5ff5f428f77259ae0df0efa290f56334cc484b81 Mon Sep 17 00:00:00 2001
From: Oliver Bertuch <o.bertuch@fz-juelich.de>
Date: Wed, 7 Nov 2018 14:00:13 +0100
Subject: [PATCH] Solves #5274. Using only the S3 part of AWS SDK pom.xml gets
 lighter.

When AWS S3 storage support was introduced back in 2017 in #3921, the team experienced
problems with the bundled Jackson library of Glassfish (2.3 instead of 2.6 minimum).
By switching to the complete bundle, the bundled Jackson library was used and problems
 where avoided.

This lead to a bigger WAR than necessary (~20 MB) and made a workaround necessary to
remove some AWS specific `javamail.providers` to avoid email problems via WAR file manipulation.

This commit:
* removes the WAR file hacking
* makes use of the S3 SDK part only, reducing the WAR size
* enables proper <dependencyManagement> for the sake of avoiding dependency convergence problems.

People unaware of direct and transitive dependencies and how to manage them are kindly requested to
have a look at the Maven docs and tutorials:
* https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html
* https://www.davidjhay.com/maven-dependency-management
* https://maven.apache.org/enforcer/maven-enforcer-plugin/index.html
---
 pom.xml | 98 +++++++++++++++++++++++++++++----------------------------
 1 file changed, 50 insertions(+), 48 deletions(-)

diff --git a/pom.xml b/pom.xml
index abba23d3308..061eafb63bc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -15,7 +15,6 @@
 	<additionalparam>-Xdoclint:none</additionalparam>
         <!-- Needed to avoid IDEA IDE compilation failures. See commits in GH #5059 -->
         <compilerArgument></compilerArgument>
-        <aws.version>1.11.172</aws.version>
         <project.timezone>UTC</project.timezone>
         <project.language>en</project.language>
         <project.region>US</project.region>
@@ -25,6 +24,12 @@
         -->
         <argLine>-Duser.timezone=${project.timezone} -Dfile.encoding=${project.build.sourceEncoding} -Duser.language=${project.language} -Duser.region=${project.region}</argLine>
     
+        <aws.version>1.11.172</aws.version>
+        <jackson.version>2.9.6</jackson.version>
+        <joda.version>2.10.1</joda.version>
+        <commons.logging.version>1.2</commons.logging.version>
+        <httpcomponents.client.version>4.5.5</httpcomponents.client.version>
+        
         <junit.version>4.12</junit.version>
         <junit.jupiter.version>5.3.1</junit.jupiter.version>
         <junit.vintage.version>5.3.1</junit.vintage.version>
@@ -69,10 +74,48 @@
         </repository>
 
     </repositories>
-  
-    <!--            Due to our old version of glassfish and its version of jackson,
-                we are pointing to an aws sdk with unique references to needed libraries.
-                If we update glassfish, we should return to the normal sdk as well. -->  
+    
+    <!-- Transitive dependencies, bigger library "bill of materials" (BOM) and
+         versions of dependencies used both directly and transitive are managed here. -->
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>com.amazonaws</groupId>
+                <artifactId>aws-java-sdk-bom</artifactId>
+                <version>${aws.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson.version}</version>
+                <scope>import</scope>
+                <type>pom</type>
+            </dependency>
+            <dependency>
+                <groupId>joda-time</groupId>
+                <artifactId>joda-time</artifactId>
+                <version>${joda.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>commons-logging</groupId>
+                <artifactId>commons-logging</artifactId>
+                <version>${commons.logging.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents</groupId>
+                <artifactId>httpclient</artifactId>
+                <version>${httpcomponents.client.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+    
+    <!-- Declare any DIRECT dependencies here.
+         In case the depency is both transitive and direct (e. g. some common lib for logging),
+         manage the version above and add the direct dependency here WITHOUT version tag, too.
+    -->
+    <!-- TODO: Housekeeping is utterly needed. -->
     <dependencies>
         <dependency>
             <groupId>org.passay</groupId>
@@ -110,7 +153,6 @@
         <dependency>
             <groupId>org.apache.httpcomponents</groupId>
             <artifactId>httpclient</artifactId>
-            <version>4.5.5</version>
         </dependency>
         <dependency>
             <groupId>org.apache.httpcomponents</groupId>
@@ -147,8 +189,8 @@
         </dependency>
         <dependency>
             <groupId>com.amazonaws</groupId>
-            <artifactId>aws-java-sdk-bundle</artifactId>
-            <version>${aws.version}</version>
+            <artifactId>aws-java-sdk-s3</artifactId>
+            <!-- no version here as managed by BOM above! -->
         </dependency>
         <dependency>
             <!-- required by org.swordapp.server.sword2-server -->
@@ -644,46 +686,6 @@
                 <artifactId>coveralls-maven-plugin</artifactId>
                 <version>4.0.0</version>
             </plugin>
-            <!-- v4.8: The truezip-maven-plugin below deletes two copies of a file that the AWS SDK bundle
-            includes called javamail.providers which breaks system emails. TODO: make our own AWS SDK without Amazon SES.
-            - bsilverstein 8/8/2017 -->
-            <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>truezip-maven-plugin</artifactId>
-                <version>1.1</version>
-                <executions>
-                    <execution>
-                        <id>remove-javamail-providers-from-exploded</id>
-                        <goals>
-                            <goal>remove</goal>
-                        </goals>
-                        <phase>package</phase>
-                        <configuration>
-                            <fileset>
-                                <directory>target/dataverse-${project.version}/WEB-INF/lib/aws-java-sdk-bundle-${aws.version}.jar/META-INF</directory>
-                                <includes>
-                                    <include>javamail.providers</include>
-                                </includes>
-                            </fileset>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>remove-javamail-providers-from-war</id>
-                        <goals>
-                            <goal>remove</goal>
-                        </goals>
-                        <phase>package</phase>
-                        <configuration>
-                            <fileset>
-                                <directory>target/dataverse-${project.version}.war/WEB-INF/lib/aws-java-sdk-bundle-${aws.version}.jar/META-INF</directory>
-                                <includes>
-                                    <include>javamail.providers</include>
-                                </includes>
-                            </fileset>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
             <plugin>
                 <!-- https://stackoverflow.com/questions/46177921/how-to-run-unit-tests-in-excludedgroups-in-maven -->
                 <artifactId>maven-surefire-plugin</artifactId>