adding slf4j-simple as a dependency, as uber jar won't allow using it via classpath

[vanrenter]

fixes #153 (hopefully)
Merge this pull request only if tools-java is used as a command line tool and is not intended to be used as a maven dependency for other artifacts. If so, this fix will force the use of slf4j-simple (console logging) in the other artifact (or requires ).

For the explanation related to comments in #153 : when using the uberjar / jar-with-dependencies, it is not enough to add slf4j-simple in the classpath. The reason is that some org.slf4j package exists inside the produced jar with dependencies. So, adding slf4j-simple to the classpath is probably ignored, but when added as a maven dependency, it will be included in the jar-with-dependencies and it will work.

The result of some Verfify with the built jar does not include the fl4j warning anymore and will now include some WARNings issued by spdx tooling:

 java -jar target/tools-java-1.1.9-SNAPSHOT-jar-with-dependencies.jar Verify testResources/SPDXTagExample-v2.3.spdx 
[main] WARN org.spdx.library.model.SpdxElement - No creation info for document Optional[SPDX-Tools-v2.0]
[main] WARN org.spdx.library.model.SimpleUriValue - URI http://spdx.org/spdxdocs/spdx-example-tv-2-3-444504E0-4F89-41D3-9A0C-0305E82C3301#LocationRef-acmeforge does not match any model object or enumeration
[main] WARN org.spdx.library.model.SimpleUriValue - URI http://spdx.org/spdxdocs/spdx-example-tv-2-3-444504E0-4F89-41D3-9A0C-0305E82C3301#LocationRef-acmeforge does not match any model object or enumeration
[main] WARN org.spdx.library.model.SimpleUriValue - URI http://spdx.org/spdxdocs/spdx-example-tv-2-3-444504E0-4F89-41D3-9A0C-0305E82C3301#LocationRef-acmeforge does not match any model object or enumeration
[main] WARN org.spdx.library.model.SimpleUriValue - URI http://spdx.org/spdxdocs/spdx-example-tv-2-3-444504E0-4F89-41D3-9A0C-0305E82C3301#LocationRef-acmeforge does not match any model object or enumeration
[main] WARN org.spdx.library.model.SimpleUriValue - URI http://spdx.org/spdxdocs/spdx-example-tv-2-3-444504E0-4F89-41D3-9A0C-0305E82C3301#LocationRef-acmeforge does not match any model object or enumeration
[main] WARN org.spdx.library.model.SimpleUriValue - URI http://spdx.org/spdxdocs/spdx-example-tv-2-3-444504E0-4F89-41D3-9A0C-0305E82C3301#LocationRef-acmeforge does not match any model object or enumeration
[main] WARN org.spdx.library.model.SimpleUriValue - URI http://spdx.org/spdxdocs/spdx-example-tv-2-3-444504E0-4F89-41D3-9A0C-0305E82C3301#LocationRef-acmeforge does not match any model object or enumeration
[main] WARN org.spdx.library.model.SimpleUriValue - URI http://spdx.org/spdxdocs/spdx-example-tv-2-3-444504E0-4F89-41D3-9A0C-0305E82C3301#LocationRef-acmeforge does not match any model object or enumeration
[main] WARN org.spdx.library.model.SimpleUriValue - URI http://spdx.org/spdxdocs/spdx-example-tv-2-3-444504E0-4F89-41D3-9A0C-0305E82C3301#LocationRef-acmeforge does not match any model object or enumeration
This SPDX Document is valid.

If you wish to remove the warnings, then probably a logback config file needs to be added to set the default log level to ERROR.

[pmonks]

Can a Maven profile be used to conditionally declare this dependency? i.e. only when building an uberjar, but not when building a library JAR

Apologies if this thought is nonsense - it's been over a decade since I used Maven regularly, so I'm working from hazy memory.

[vanrenter]

Using maven profile is probably an option. But probably it will need some work on the github actions to build the uberjar with one profile and the "regular" maven jar with another. I will try that in the pull request if you like.
Note that there is also another option for maven artefacts that wish to depend on tools-java : exclude slf4j-simple in their pom. That does not need maven profiles, but requires some attention from the maven consumers

<!-- pom from tools-java consumer -->
...
<dependencies>
  <dependency>
    <groupId>org.spdx</groupId>
    <artifactId>tools-java</artifactId>
    <version>1.1.9</version>
    <exclusions>
      <exclusion>
        <groupId>org.slf4j</groupId>
	<artifactId>slf4j-simple</artifactId>
      <exclusion>
    </exclusions>
  </dependency>
</dependencies>

[goneall]

We're using the Maven release plugin to generate the release artifacts which uses a single release profile. I'm not sure how this would mix with creating a separate profile for the logging.

I did a bit of digging on the shade plugin used to generate the uber jar. It looks like you can specify included dependencies, but (rather inconveniently) you need to list all of the included dependencies - you can't just add one additional file.

[goneall]

Note that there is also another option for maven artefacts that wish to depend on tools-java : exclude slf4j-simple in their pom. That does not need maven profiles, but requires some attention from the maven consumers

I'm tempted to just document this in the README file and go with the dependency solution.

[vanrenter]

I think I found a way to achieve this without maven profiles:

• I did add slf4j-simple as an optional dependency

  • so it is not passed to maven artefacts depending on tools-java
  • see below in a sample maven project depending from tools-java : only slf4j-api
    

• I indeed changed maven-shade-plugin config to include org/slf4j/** and META-INF/services/** from slf4j-simple in the uberjar

  • META-INF/services/** is needed in the uberjar to declare which implementation of slf4j logger to use
  • from command line output of tools-java, it works

I will make a new commit with this.

[goneall]

Thanks @vanrenter - this looks like it should work. I'll give one more day to see if there are any additional review comments then merge it in.

[goneall]

LGTM