https://gradle.com/ logo
Join Slack
Powered by
Hi all, I found this outdate package in my verific...
# community-support
a
Hi all, I found this outdate package in my verification-metadata.xml.
Copy code
<component group="org.bouncycastle" name="bcprov-jdk18on" version="1.76">
         <artifact name="bcprov-jdk18on-1.76.jar">
            <sha256 value="fda85d777aaae168015860b23a77cad9b8d3a1d5c904fda875313427bd560179" origin="Generated by Gradle"/>
         </artifact>
         <artifact name="bcprov-jdk18on-1.76.pom">
            <sha256 value="153009592d3b8f8349f97b8f1538bef0c83341b026918a2327dace22334ffee8" origin="Generated by Gradle"/>
         </artifact>
      </component>
How can I find it which package is using it? I tried with the following command but no luck.
Copy code
./gradlew dependencyInsight --dependency org.bouncycastle:bcprov-jdk18on --configuration compileClasspath
./gradlew dependencyInsight --dependency org.bouncycastle:bcprov-jdk18on --configuration testCompileClasspath
c
it'll be easier to find using the report in --scan
what you're using might not work if you don't know what project its in
as dependencyInsight does not search subprojects and the like
v
Or if you can't use scan, then 
dependencies
instead of 
dependencyInsight
as then you can list the whole tree for all configurations of one project. Still does not support multi-project ootb though
a
I did try with 
dependencies
also no luck
how can I use scan for dependencies?
c
you have to visit the url it gives you
which will run you through some unlock via email stuff
and then there's a dependencies section which is hopefully intuitive
this is the very simple way to make gradle dependencies give you all of them for subprojects, it's in my root project
Copy code
tasks.dependencies {
  dependsOn(subprojects.map { "${it.path}:dependencies" })
}
don't know if it works for composite projects
v
No
c
it is not a very readable and not paresable report
a
Weird…. Still can not find it
v
Maybe you needed it in the past and did upgrade beyond?
c
it occurs to me that I didn't say 
./gradlew build --scan
what dependencies show up depend on the task you run
☝️ 1
AFAIK
if it's not in build, and you use my dependencies code (above) for 
./gradlew dependencies --scan
and you aren't using composite projects, and vampire isn't right about that upgrade..
I'd say grep lockfiles if you have them... this won't tell you what dependency pulls it in, but it can narrow your search quite a bit
a
But I do generate new verification-metadata.. will that remove dependency I need in the past
c
presuming that the verification-metadata is run by some task... running that task with --scan, should work
a
Let me try
I searched on both report... and can not find keyword 
bouncycastle
c
so your report doesn't have it anymore? or is there a possibility something outside of gradle is adding this? it's not clear that you get the report from gradle
unfortunately I think I've given every suggestion I can think of either way.
v
Can you show your build scan?
a
I am not sure why verification-metadata get the dependency..
but thanks
v
I didn't use dependency verification so far, does it maybe not remove things? If you delete it and regenerate it, does it then land in there?
a
yes, I did try delete and regenerate. It is still there
v
Do as Caleb suggested and run that with 
--scan
a
yes, the --scan report don't have entry like 
org.bouncycastle
v
Show it?
a
6 Views
Open in Slack
PreviousNext
Powered by