Shading dependencies

Hi,

I want to request that docusign-esign-java be shaded using maven-shade-plugin.

Our company is currently adopting the DocuSign Java SDK and found that docusign-esign-java is not shaded. This is especially concerning, as docusign-esign-java is not a thin client and have many external dependencies. Particularly for us, docusign-esign-java is pulling in org.glassfish.jersey.media:jersey-media-json-jackson which conflicts with org.glassfish.jersey.media:jersey-media-jaxb (which is being pulled in by io.dropwizard). Please see here on why this would be an issue.

I would assume most (if not all) enterprise Java applications would utilize a Java framework, including Jersey. I would see this being an issue for many other companies that are trying to integrate DocuSign into their system.

I have already confirmed that shading docusign-esign-java resolves any conflicts.

Please let me know if I can provide any supplementary detail. Thank you for taking the time to read through this 🙂.

Hi David,

Thanks for sharing this. I saw your post this weekend and am touching base with our engineers internally to evaluate this issue.

This would be a fantastic feature.
We have a lot of dependancy clashes because of the docusign-esign-java client.

@rjdkolb

@rjdkolb @jglassenberg I ended up hosting my own shaded artifact on JFrog. Adding maven-shade-plugin to the pom.xml would shade the transitive dependencies.

<build>
    <plugins>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-shade-plugin</artifactId>
            <version>3.3.0</version>
            <executions>
                <execution>
                    <phase>package</phase>
                    <goals>
                        <goal>shade</goal>
                    </goals>
                    <configuration>
                        <createSourcesJar>true</createSourcesJar>
                        <shadeSourcesContent>true</shadeSourcesContent>
                        <filters>
                            <filter>
                                <artifact>*:*</artifact>
                                <excludes>
                                    <exclude>INSTALL.html</exclude>
                                    <exclude>LICENSE</exclude>
                                    <exclude>README</exclude>
                                    <exclude>META-INF/*.SF</exclude>
                                    <exclude>META-INF/*.DSA</exclude>
                                    <exclude>META-INF/*.RSA</exclude>
                                    <exclude>META-INF/ASL2.0</exclude>
                                    <exclude>META-INF/DEPENDENCIES.txt</exclude>
                                    <exclude>META-INF/LICENSE.txt</exclude>
                                    <exclude>META-INF/NOTICE.txt</exclude>
                                    <exlude>overview.html</exlude>
                                </excludes>
                            </filter>
                        </filters>
                        <relocations>
                            <relocation>
                                <pattern>io.swagger</pattern>
                                <shadedPattern>com.docusign.shaded.io.swagger</shadedPattern>
                            </relocation>
                            <relocation>
                                <pattern>org.glassfish</pattern>
                                <shadedPattern>com.docusign.shaded.org.glassfish</shadedPattern>
                            </relocation>
                            <relocation>
                                <pattern>com.fasterxml</pattern>
                                <shadedPattern>com.docusign.shaded.com.fasterxml</shadedPattern>
                            </relocation>
                            <relocation>
                                <pattern>com.brsanthu</pattern>
                                <shadedPattern>com.docusign.shaded.com.brsanthu</shadedPattern>
                            </relocation>
                            <relocation>
                                <pattern>org.apache</pattern>
                                <shadedPattern>com.docusign.shaded.org.apache</shadedPattern>
                            </relocation>
                            <relocation>
                                <pattern>org.bouncycastle</pattern>
                                <shadedPattern>com.docusign.shaded.org.bouncycastle</shadedPattern>
                            </relocation>
                            <relocation>
                                <pattern>com.auth0</pattern>
                                <shadedPattern>com.docusign.shaded.com.auth0</shadedPattern>
                            </relocation>
                            <relocation>
                                <pattern>org.slf4j</pattern>
                                <shadedPattern>com.docusign.shaded.org.slf4j</shadedPattern>
                            </relocation>
                            <relocation>
                                <pattern>org.aopalliance</pattern>
                                <shadedPattern>com.docusign.shaded.org.aopalliance</shadedPattern>
                            </relocation>
                            <relocation>
                                <pattern>org.json</pattern>
                                <shadedPattern>com.docusign.shaded.org.json</shadedPattern>
                            </relocation>
                            <relocation>
                                <pattern>org.jvnet</pattern>
                                <shadedPattern>com.docusign.shaded.org.jvnet</shadedPattern>
                            </relocation>
                        </relocations>
                        <dependencyReducedPomLocation>target/reduced-pom.xml</dependencyReducedPomLocation>
                    </configuration>
                </execution>
            </executions>
        </plugin>
    </plugins>
</build>

The decision was to use uber jar. Here is how you can get 3.19.0 with Maven (similar syntax exits for Gradle and others):

<dependency>
  <groupId>com.docusign</groupId>
  <artifactId>docusign-esign-java</artifactId>
  <version>3.19.0</version>
  <classifier>shaded</classifier>
</dependency>

@mmallis87

@mmallis87 I tried pulling 3.19.0 into our project as you suggested and my Maven build failed with the following error:

Security Invalid signature file digest for Manifest main attributes

I'm wondering if this error shows up for anyone else.

My suspicion is that manifest signature files under META-INF need to be excluded from shading, as can be found here.

Version 3.19.0 release (#233)

@davidsubskribe

@davidsubskribe I also tried pulling in 3.19.0 as @mmallis87 suggested, but I received the same Maven build error. I am experimenting with excluding signature files as you mentioned.

Not sure if that's the best option to go with (according to an answer by MattW, but time will tell.

If anyone else finds an elegant solution for this, please do share it!

Navigation Menu

Repository navigation

Shading dependencies #211

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Shading dependencies #211

Description

Activity

jglassenberg commented on Oct 25, 2021

rjdkolb commented on May 24, 2022

davidsubskribe commented on May 26, 2022

mmallis87 commented on May 27, 2022

davidsubskribe commented on May 27, 2022

jacobbrokaw commented on Jun 28, 2022

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions