endpoints-management-control-all does not properly shade OpenCensus

[meltsufin]

This is causing diamond dependency issues.

See: spring-attic/spring-cloud-gcp#1815 (comment)

[elharo]

It probably shouldn't shade this. Rather it should simply depend on the usual jar rather than bundling it.

[suztomo]

Pasting my findings on duplicate class via Maven extra-enforcer rule's banDuplicateClasses:

Duplicate classes found:

  Found in:
    com.google.endpoints:endpoints-management-control-appengine-all:jar:1.0.11:compile
    javax.transaction:transaction-api:jar:1.1:compile
  Duplicate classes:
    javax/transaction/SystemException.class
    (...omit ...)
    javax/transaction/TransactionSynchronizationRegistry.class

  Found in:
    com.google.errorprone:error_prone_annotations:jar:2.3.2:compile
    com.google.endpoints:endpoints-management-control-appengine-all:jar:1.0.11:compile
  Duplicate classes:
    com/google/errorprone/annotations/Var.class
    com/google/errorprone/annotations/concurrent/LockMethod.class
    com/google/errorprone/annotations/FormatString.class
    (...omit ...)
    com/google/errorprone/annotations/Immutable.class
    com/google/errorprone/annotations/RestrictedApi.class

  Found in:
    com.google.code.findbugs:jsr305:jar:3.0.2:compile
    com.google.endpoints:endpoints-management-control-appengine-all:jar:1.0.11:compile
  Duplicate classes:
    javax/annotation/WillCloseWhenClosed.class
    javax/annotation/meta/TypeQualifierValidator.class
    javax/annotation/concurrent/Immutable.class
    (...omit ...)
    javax/annotation/RegEx$Checker.class

  Found in:
    org.apache.tomcat.embed:tomcat-embed-core:jar:9.0.21:compile
    javax.servlet:servlet-api:jar:2.5:compile
    com.google.endpoints:endpoints-management-control-appengine-all:jar:1.0.11:compile
  Duplicate classes:
    javax/servlet/http/HttpSessionAttributeListener.class
    javax/servlet/SingleThreadModel.class
    (...omit ...)
    javax/servlet/http/HttpSession.class
    javax/servlet/http/HttpSessionEvent.class

  Found in:
    com.google.endpoints:endpoints-management-control-appengine-all:jar:1.0.11:compile
    io.opencensus:opencensus-contrib-grpc-metrics:jar:0.19.2:compile
  Duplicate classes:
    io/opencensus/contrib/grpc/metrics/RpcViews.class
    io/opencensus/contrib/grpc/metrics/RpcViewConstants.class
    io/opencensus/contrib/grpc/metrics/RpcMeasureConstants.class

  Found in:
    com.google.endpoints:endpoints-management-control-appengine-all:jar:1.0.11:compile
    javax.jdo:jdo2-api:jar:2.3-eb:compile
  Duplicate classes:
    javax/jdo/annotations/ForeignKey.class
    javax/jdo/spi/JDOImplHelper.class
    (...omit ...)
    javax/jdo/listener/LoadLifecycleListener.class
    javax/jdo/annotations/PersistenceCapable.class

  Found in:
    io.opencensus:opencensus-api:jar:0.23.0:compile
    com.google.endpoints:endpoints-management-control-appengine-all:jar:1.0.11:compile
  Duplicate classes:
    io/opencensus/stats/AutoValue_ViewData.class
    io/opencensus/trace/TraceOptions$Builder.class
    (...omit ...)
    io/opencensus/tags/unsafe/ContextUtils$1.class
    io/opencensus/trace/samplers/Samplers.class
    io/opencensus/stats/Aggregation.class

  Found in:
    com.google.endpoints:endpoints-management-control-appengine-all:jar:1.0.11:compile
    com.google.api.grpc:proto-google-common-protos:jar:1.16.0:compile
  Duplicate classes:
    com/google/cloud/audit/AuthorizationInfo$Builder.class
    com/google/cloud/audit/AuthenticationInfo.class
    (...omit ...)
    com/google/cloud/audit/AuditLogOrBuilder.class
    com/google/cloud/audit/AuthenticationInfoOrBuilder.class

These are the risks endpoints-management-control-appengine-all may shadow classes at users' runtime.

[elharo]

Again, the issue is not that it doesn't shade these classes. It shouldn't shade them. It shouldn't bundle them either.

[suztomo]

I agree that this library should not shade dependencies.