Open source Bazel Maven Config Generator website

[jart]

This directory contains the source code to a website that runs on Google Apps Script. It crawls Maven POM metadata to generate WORKSPACE configs using java_import_external.

Please watch the demo video on YouTube.

Features

• Defines all transitive relationships
• Resolves diamond conflicts by bumping versions
• Calculates SHA256 (slow due to Apps Script API issue)
• Documents licenses and heuristically categorizes them
• Heuristics for neverlink (provided) jars
• Source jars and optional dependencies
• Mirrors jars to Google Drive
• Adds iBiblio URLs if 200 OK

Verbosity

The huge config is good because it makes builds deterministic, highly available, and fast because Bazel won't need to BFS HTTP POMs each build. Even Java projects with hundreds of transitive dependencies can expect bazel fetch //.... to take seconds.

You'll also see all the mysterious code from the Internet that you're running on your machine. For example, you might discover Apache Commons Collections 3.2.1 on the classpath, in which case it's game over if anything in the JVM is deserializing. So the verbosity might actually save you from ending up in the same boat as Equifax. See Operation Rosehub to learn more.

Imperfection

Another reason why the generated config is huge is because it only gets you 90% there. You will need to make subtle adjustments after using the tool. See the README in the PR to learn more.

[laszlocsomor]

ping -- are there any updates?

[lfpino]

Hi @davidstanke, Bazel sheriff here, what's the status of this pull request? It hasn't been updated for more than a week so it'd be good to understand if it's still ongoing or safe to close. Thanks.

[jin]

We're moving towards https://github.com/bazelbuild/rules_jvm_external/ for transitive Maven dependency resolution.