Verify dependencies in a Maven build

Question

Is there a way to write a test that checks Maven dependencies?

In our project, we found these problems:

Some parts of the project use commons-io:commons-io, others used org.apache.commons:commons-io
The wrong version of a dependency was used
stax uses the versions 1.0-2 and 1.0.1. Using the automatic dependency resolution, 1.0-2 wins.

So what I want is to write a test case which takes the current dependency tree as input and runs a couple of checks on it. Is that possible?

score 1 · Accepted Answer · edited May 23 '17 at 12:12

@Test
public void testCommonsIo() throws Exception {
    assertDependencyVersion("commons-io", "commons-io", "2.0");
}

private void assertDependencyVersion(final String groupId, 
        final String artifactId, final String expectedVersion) 
        throws IOException {

    final StringBuilder sb = new StringBuilder("/META-INF/maven/");
    sb.append(groupId).append("/").append(artifactId);
    sb.append("/pom.properties");
    final String resourcePath = sb.toString();

    final InputStream propertiesStream = this.getClass()
        .getResourceAsStream(resourcePath);
    assertNotNull("no dependency found: " + groupId + ":" + artifactId, 
        propertiesStream);

    final Properties properties = new Properties();
    properties.load(propertiesStream);

    assertEquals("group", groupId, properties.getProperty("groupId"));
    assertEquals("artifact", artifactId, properties.getProperty("artifactId"));
    assertEquals("version", expectedVersion, properties.getProperty("version"));
}

Check this answer too.

Here is an assert method for StAX and other dependencies which don't contain pom.properties just manifest.mf. Maybe it would worth caching the Properties instances if there are lots of assertDependencyByMetaInf calls.

@Test
public void testStaxDependency() throws Exception {
    assertDependencyByMetaInf("StAX", "1.0.1");
}

private void assertDependencyByMetaInf(final String specTitle, 
        final String expectedSpecVersion) throws IOException {
    final ClassLoader cl = this.getClass().getClassLoader();

    final String resourcePath = "META-INF/MANIFEST.MF";
    final Enumeration<URL> resources = cl.getResources(resourcePath);

    boolean found = false;
    while (resources.hasMoreElements()) {
        final URL url = resources.nextElement();
        final InputStream metaInfStream = url.openStream();

        final Properties metaInf = new Properties();
        metaInf.load(metaInfStream);

        final String metaInfSpecTitle = 
            metaInf.getProperty("Specification-Title");
        if (!specTitle.equals(metaInfSpecTitle)) {
            continue;
        }

        final String specVersion = 
            metaInf.getProperty("Specification-Version");
        assertEquals("version mismatch for " + specTitle, 
            expectedSpecVersion, specVersion);
        found = true;
    }
    assertTrue("missing dependency: " + specTitle, found);
}

-1 All JARs that I checked only contain a pom.properties file for the artifact itself. None of the dependencies are included. — Aaron Digulla, Oct 14 '11 at 09:26
Transitive dependencies also are on the classpath, so `getResourceAsStream` find their `pom.properties`. — palacsint, Oct 14 '11 at 10:11
Ah, I see. Changed my vote. Note: Some JARs from Maven Central don't have a pom.properties entry :-( For example stax-api (http://search.maven.org/#artifactdetails%7Cstax%7Cstax-api%7C1.0.1%7Cjar) — Aaron Digulla, Oct 14 '11 at 14:53

score 0 · Answer 2 · answered Oct 14 '11 at 14:51

Following the advice from palacsint, here is another approach: Count how often a class is on the classpath and print the URLs if there is more than one.

private void assertOnceOnClassPath( String resourcePath ) throws IOException {
    ClassLoader cl = getClass().getClassLoader();

    Enumeration<URL> resources = cl.getResources( resourcePath );
    List<URL> urls = new ArrayList<URL>();
    while( resources.hasMoreElements() ) {
        URL url = resources.nextElement();
        urls.add( url );
    }

    if( urls.size() != 1 ) {
        fail( "Expected exactly 1 item:\n" + StringUtils.join( urls, "\n" ) );
    }
}

Verify dependencies in a Maven build

2 Answers2