为什么不能使用POM文件中的Maven依赖项? [英] How come maven dependencies in POM file can't be used?
问题描述
我的任务是为开发人员提供一种将单个依赖项添加到Android项目上的build.gradle文件中，使用我准备的一些(混淆的)SDK(AAR文件-Android库)的方法.
I'm tasked to provide a way for developers to add a single dependency into build.gradle file on Android project, to use some (obfuscated) SDK I've prepared (AAR file - Android library).
SDK本身使用各种依赖关系，因此在最终代码中可用它们非常重要，这意味着使用该SDK的人不会因为未找到类而看到崩溃.
The SDK itself uses various dependencies, so it's important that they will be available in the final code, meaning the whoever uses the SDK won't see crashes due to class-not-found.
SDK作为私有存储库存储在Github上，并且可以通过Jitpack开发人员使用，该工具会扫描存储库中的POM文件和其他一些文件.
The SDK is stored on Github as a private repository, and available for developers via Jitpack, which scans POM file and some other files on the repository.
仅使用AAR文件，就必须设置与SDK相同(或更新)的依赖项.
Using the AAR file alone, you have to set the same (or newer) dependencies as on the SDK.
但是，如果在发布时使用POM文件，则使用者(无论使用SDK的人)都不需要编写SDK上的每个依赖项，因为它是从POM文件中添加的.
However, if you use POM file while publishing, the consumer (whoever uses the SDK) shouldn't need to write each dependency that's on the SDK, as it gets added from the POM file.
由于某种原因，这种行为对我来说并不存在.这就意味着，SDK好像不使用任何依赖关系，因此，如果我尝试使用任何依赖关系，都无法访问类，并且如果我尝试在使用某些依赖关系时尝试使用SDK，则会导致异常的ClassNotFoundException.
For some reason, this behavior doesn't exist for me. Meaning that it's as if the SDK doesn't use any depdendency, so if I try to use any of the depdendencies I can't reach the classes, and if I try to use the SDK when it uses some depdendency, it causes an exception of ClassNotFoundException.
起初我以为这是由于一些Proguard规则引起的，但是后来我注意到它也发生在(使用SDK的应用程序的)调试变量上.
At first I thought it's because of some Proguard rules, but then I noticed that it happens on debug-variant too (of the app that uses the SDK).
因此，例如，由于库在依赖项中使用了它:
So for example, as the library uses this in the dependencies:
implementation 'androidx.security:security-crypto:1.1.0-alpha03'
如果我不使用它，则无法达到此依赖项的任何类别，并且如果SDK尝试达到此依赖项的任何类别，则应用程序将崩溃.
And if I don't use the same, I can't reach any class of this dependency, and if the SDK tries to reach any class of it, the app will crash.
因此，我不必添加使用SDK的单一依赖关系，而必须添加SDK已经使用的所有依赖关系.
So instead of a single dependency of using the SDK and that's it, I have to add all of the dependencies that the SDK already uses.
要生成AAR文件，请使用"assembleRelease"gradle任务，并生成POM文件，我使用"generatePomFileForReleasePublication"(或"publishReleasePublicationToMavenLocal")gradle任务.
To generate the AAR file, I use "assembleRelease" gradle task, and to generate the POM file, I use the "generatePomFileForReleasePublication" (or "publishReleasePublicationToMavenLocal") gradle task.
该库具有相当大的依赖性.这是它的build.gradle文件:
The library has quite some dependencies. This is the build.gradle file of it:
plugins {
id 'com.android.library'
id 'kotlin-android'
id 'kotlin-kapt'
id 'kotlin-parcelize'
id 'io.michaelrocks.paranoid'
id 'maven-publish'
id 'com.github.dcendents.android-maven'
}
android {
compileSdkVersion 30
defaultConfig {
minSdkVersion 21
targetSdkVersion 30
versionCode 1
versionName "1.0"
}
buildTypes {
release {
minifyEnabled true
proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
consumerProguardFiles 'consumer-rules.pro'
}
}
compileOptions {
sourceCompatibility JavaVersion.VERSION_1_8
targetCompatibility JavaVersion.VERSION_1_8
}
kotlinOptions {
jvmTarget = '1.8'
}
configurations {
all {
exclude module: 'httpclient'
}
}
packagingOptions {
//for google login token
exclude 'META-INF/DEPENDENCIES'
}
}
dependencies {
api "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
api 'androidx.core:core-ktx:1.6.0-alpha01'
api 'androidx.collection:collection-ktx:1.2.0-alpha01'
api 'androidx.security:security-crypto:1.1.0-alpha03'
def room_version = "2.2.6"
api "androidx.room:room-runtime:$room_version"
kapt "androidx.room:room-compiler:$room_version"
api "androidx.room:room-ktx:$room_version"
api 'com.squareup.retrofit2:retrofit:2.9.0'
api 'com.squareup.retrofit2:converter-gson:2.9.0'
api 'com.squareup.okhttp3:okhttp:5.0.0-alpha.2'
api 'com.squareup.okhttp3:logging-interceptor:5.0.0-alpha.2'
api('com.google.android.gms:play-services-auth:19.0.0')
api('com.google.auth:google-auth-library-oauth2-http:0.25.0')
api('com.google.apis:google-api-services-people:v1-rev99-1.22.0') {
exclude group: 'com.google.guava'
}
api 'io.michaelrocks:libphonenumber-android:8.12.20'
}
afterEvaluate {
publishing {
publications {
release(MavenPublication) {
from components.release
}
}
}
}
运行任务"generatePomFileForReleasePublication".我收到了POM文件"pom-default.xml"，:
Running the task of "generatePomFileForReleasePublication" I got the POM file "pom-default.xml" :
<?xml version="1.0" encoding="UTF-8"?>
<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<!-- This module was also published with a richer model, Gradle metadata, -->
<!-- which should be used instead. Do not delete the following line which -->
<!-- is to indicate to Gradle or any Gradle module metadata file consumer -->
<!-- that they should prefer consuming it instead. -->
<!-- do_not_remove: published-with-gradle-metadata -->
<modelVersion>4.0.0</modelVersion>
<groupId>MySdk</groupId>
<artifactId>library</artifactId>
<version>unspecified</version>
<packaging>aar</packaging>
<dependencies>
<dependency>
<groupId>org.jetbrains.kotlin</groupId>
<artifactId>kotlin-stdlib</artifactId>
<version>1.4.32</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>androidx.core</groupId>
<artifactId>core-ktx</artifactId>
<version>1.6.0-alpha01</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>androidx.collection</groupId>
<artifactId>collection-ktx</artifactId>
<version>1.2.0-alpha01</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>androidx.security</groupId>
<artifactId>security-crypto</artifactId>
<version>1.1.0-alpha03</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>androidx.room</groupId>
<artifactId>room-runtime</artifactId>
<version>2.2.6</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>androidx.room</groupId>
<artifactId>room-ktx</artifactId>
<version>2.2.6</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.squareup.retrofit2</groupId>
<artifactId>retrofit</artifactId>
<version>2.9.0</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.squareup.retrofit2</groupId>
<artifactId>converter-gson</artifactId>
<version>2.9.0</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
<version>5.0.0-alpha.2</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>logging-interceptor</artifactId>
<version>5.0.0-alpha.2</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.google.android.gms</groupId>
<artifactId>play-services-auth</artifactId>
<version>19.0.0</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.google.auth</groupId>
<artifactId>google-auth-library-oauth2-http</artifactId>
<version>0.25.0</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.google.apis</groupId>
<artifactId>google-api-services-people</artifactId>
<version>v1-rev99-1.22.0</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
<exclusion>
<artifactId>*</artifactId>
<groupId>com.google.guava</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>io.michaelrocks</groupId>
<artifactId>libphonenumber-android</artifactId>
<version>8.12.20</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.jetbrains.kotlin</groupId>
<artifactId>kotlin-parcelize-runtime</artifactId>
<version>1.4.32</version>
<scope>runtime</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>io.michaelrocks</groupId>
<artifactId>paranoid-core</artifactId>
<version>0.3.3</version>
<scope>runtime</scope>
<exclusions>
<exclusion>
<artifactId>httpclient</artifactId>
<groupId>*</groupId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
</project>
根据各种网站，这似乎是有效和良好的，但是可悲的是，正如我所写的那样，当我使用它时，好像这些依赖项都不存在，我需要在消费者端声明它们.
According to various websites, this seems valid and good, but sadly as I wrote, when I use it, it's as if none of these dependencies exist, and I need to declare them all on the consumer side.
在Jitpack的文件("jitpack.yml")中，我有类似以下内容:
In Jitpack's file ("jitpack.yml" ) , I have something like this:
install:
- FILE="-Dfile=library-release.aar"
- mvn install:install-file $FILE -DgroupId=my-sdk -DartifactId=MySdk -Dversion=1.0 -Dpackaging=aar -DgeneratePom=true
我尝试过的事情:
- 我尝试使用实现"和"api".没有帮助.
- 我试图从所有
dependency标记中删除scope.没有帮助. - 我尝试在用户端添加
transitive = true，但这没有做任何事情，可能是因为无论如何默认情况下都是这样. - 删除POM文件在Jitpack上没有显示警告，表明它甚至可能没有检出它.
- 我注意到POM文件提到该模块还发布了更丰富的模型Gradle元数据，应改为使用它"，因此我尝试查找此文件，但是找不到.运行
publishToMavenLocal任务，我得到了另一个文件("module.json")，甚至把它放在文件中，而不仅仅是pom-default.xml文件(以及完全替换)，没有帮助. - 我认为"jitpack.yml"文件与和gradle文件，因此我在它们两个上都为"groupId"，"artifactId"和"version"设置了相同的值.
- I tried using either "implementation" and "api". Didn't help.
- I tried to remove the
scopefrom all of thedependencytags. Didn't help. - I tried adding
transitive = trueon consumer side, but this didn't do anything, probably because it's as such by default anyway. - Removing the POM file showed no warning on Jitpack, showing that it might not even check it out.
- I've noticed the POM file mentions "This module was also published with a richer model, Gradle metadata, which should be used instead", so I tried finding this file, but couldn't. Running
publishToMavenLocaltask, I got another file ("module.json"), and even putting it instead of justpom-default.xmlfile alone (and also as a complete replacement), it didn't help. - I thought that there is some inconsistency between the file of "jitpack.yml" and the gradle file, so I've set on both of them the same values for "groupId","artifactId", and "version".
问题
- 消费者方面的依赖性如何被忽略?我怎样才能解决这个问题?我可能想念的很简单...
- Jitpack到底需要哪些文件?哪些是强制性的?哪些是可选的?
- 是否还可以避免在消费者方面使用
packagingOptions {排除'META-INF/DEPENDENCIES'}部分? - 奖金:我注意到JavaDocs(或者在我的情况下为Kdocs，正如我在Kotlin中编写的"thingthign")也被完全忽略了.我也该如何使这些内容可访问和可读?
推荐答案
好的，我已经找到了解决方法.答案来自Jitpack支持本身.首先，引用他们的话:
OK I've found the way to do this. The answer came from Jitpack support itself. First, the quote from them:
这是由安装命令和'-DgeneratePom = true'引起的范围.它将生成一个新的pom文件，但它不知道关于依赖项的任何事情.
This is caused by the install command and ' -DgeneratePom=true' parameter. It will generate a new pom file but it doesn't know anything about dependencies.
如果您已经拥有一个包含所有依赖项的pom文件，则您可以将其添加到GitHub存储库中.代替 '-DgeneratePom = true'，您可以使用'-DpomFile ='
If you already have a pom file with all the dependencies then you could add it to the GitHub repository. Instead of ' -DgeneratePom=true' you could use '-DpomFile='
我们建议在JitPack上运行之前在本地尝试该命令.
We recommend trying that command locally before running on JitPack.
另一个选择是将库的所有源代码放在JitPack并从源代码构建.
The other option is to put all the source code of the library on JitPack and build from source.
确实，如果我使用它(并且在库的依赖项中包含"api")，我的大部分问题都会得到回答:
And indeed, if I use this (and have "api" in the library's dependencies) I got most of my questions answered:
- 它解决了依赖性问题(是的，您不必自定义
-DgroupId = my-sdk -DartifactId = MySdk -Dversion = 1.0):
install:
- FILE="-Dfile=library-release.aar"
- mvn install:install-file $FILE -Dpackaging=aar -DpomFile=pom-default.xml
-
当前存在的文件似乎只有这些文件:jitpack.yml，library-release.aar，pom-default.xml.
The files that are currently there seem to be just those: jitpack.yml, library-release.aar, pom-default.xml .
显然现在不需要.可能是由解决依赖性问题的同一件事解决的.
Apparently it's not needed now. Probably fixed by the same thing that fixed the dependencies issue.
话虽如此，现在我对此有以下疑问:
That being said, now I have these questions about it:
-
"pom-default.xml"中的建议是什么?使用不同的文件(该模块还发布了更丰富的模型Gradle元数据，应改为使用该模型.")?它在哪里?也许是"module.json"文件?我尝试改用它，但随后Jitpack出现错误.
What's with the recommendation inside "pom-default.xml" to use a different file ("This module was also published with a richer model, Gradle metadata, which should be used instead.") ? Where is it? Is it perhaps the "module.json" file? I tried to use it instead, but then Jitpack got an error with it.
该用例的Jitpack文档在哪里?他们有一些关于私有存储库的东西，但是没有关于AAR文件的东西.实际上，关于"jitpack.yml"文件.
Where is the documentation of Jitpack of this use case? They have something about private repositories, but not about AAR files. In fact there is nothing I could see about the "jitpack.yml" file.
自定义 -DgroupId = my-sdk -DartifactId = MySdk -Dversion = 1.0 部分的目的是什么?在"jitpack.yml"中文件或在库的gradle文件中?我认为他们什么也没做...似乎Github存储库本身就是决定消费者如何使用它的存储库.
What's the purpose of customizing the -DgroupId=my-sdk -DartifactId=MySdk -Dversion=1.0 part? Either in the "jitpack.yml" file or in the gradle file of the library? I don't think they do anything at all... It seems the Github repository itself is the one that determines to the consumer how to use it.
我还如何添加JavaDocs和Kdocs(Kotlin的)以在此处使用?
How can I also add JavaDocs and Kdocs (of Kotlin) to be used here?
即使这是我所提问题的主要答案，但如果其他人对我的回答都很好，我将给予赏金:)
Even though this is the main answer for my questions, I will grant the bounty for whoever answers me well for the rest :)
这篇关于为什么不能使用POM文件中的Maven依赖项?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
