feat(build): enable dependency verification

Author: halibobo1205

actuator/build.gradle

@@ -1,9 +1,7 @@
 description = "actuator – a series of transactions for blockchain."
 
 dependencies {
-    compile project(":chainbase")
-    compile project(":protocol")
-    compile project(":crypto")
+    api project(":chainbase")
 }
 
 test {

build.gradle

@@ -4,9 +4,8 @@ allprojects {
 }
 
 subprojects {
-    apply plugin: "java"
+    apply plugin: "java-library"
     apply plugin: "jacoco"
-    apply plugin: "maven"
     apply plugin: "maven-publish"
 
     sourceCompatibility = JavaVersion.VERSION_1_8
@@ -36,18 +35,18 @@ subprojects {
     }
 
     dependencies {
-        compile group: 'org.slf4j', name: 'slf4j-api', version: '1.7.25'
-        compile group: 'org.slf4j', name: 'jcl-over-slf4j', version: '1.7.25'
-        compile group: 'ch.qos.logback', name: 'logback-classic', version: '1.2.9'
-        compile group: 'com.google.guava', name: 'guava', version: '30.1-jre'
-        compile "com.google.code.findbugs:jsr305:3.0.0"
-        compile group: 'org.springframework', name: 'spring-context', version: '5.3.18'
-        compile group: 'org.springframework', name: 'spring-tx', version: '5.3.18'
-        compile "org.apache.commons:commons-lang3:3.4"
-        compile group: 'org.apache.commons', name: 'commons-math', version: '2.2'
-        compile "org.apache.commons:commons-collections4:4.1"
-        compile group: 'joda-time', name: 'joda-time', version: '2.3'
-        compile group: 'org.bouncycastle', name: 'bcprov-jdk15on', version: '1.69'
+        implementation group: 'org.slf4j', name: 'slf4j-api', version: '1.7.25'
+        implementation group: 'org.slf4j', name: 'jcl-over-slf4j', version: '1.7.25'
+        implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.2.9'
+        implementation group: 'com.google.guava', name: 'guava', version: '30.1-jre'
+        implementation "com.google.code.findbugs:jsr305:3.0.0"
+        implementation group: 'org.springframework', name: 'spring-context', version: '5.3.18'
+        implementation group: 'org.springframework', name: 'spring-tx', version: '5.3.18'
+        implementation "org.apache.commons:commons-lang3:3.4"
+        implementation group: 'org.apache.commons', name: 'commons-math', version: '2.2'
+        implementation "org.apache.commons:commons-collections4:4.1"
+        implementation group: 'joda-time', name: 'joda-time', version: '2.3'
+        implementation group: 'org.bouncycastle', name: 'bcprov-jdk15on', version: '1.69'
 
         compileOnly 'org.projectlombok:lombok:1.18.12'
         annotationProcessor 'org.projectlombok:lombok:1.18.12'
@@ -64,9 +63,14 @@ subprojects {
     }
 
 
-    tasks.withType(AbstractArchiveTask) {
+    tasks.withType(AbstractArchiveTask).all {
         preserveFileTimestamps = false
         reproducibleFileOrder = true
+        duplicatesStrategy = DuplicatesStrategy.INCLUDE // allow duplicates
+    }
+
+    tasks.withType(Copy).all {
+        duplicatesStrategy = DuplicatesStrategy.INCLUDE // allow duplicates
     }
 
     configurations.all {

chainbase/build.gradle

@@ -7,12 +7,10 @@ def jansiVersion = "1.16"
 // --------------------------------------
 
 dependencies {
-    compile project(":protocol")
-    compile project(":common")
-    compile project(":crypto")
-    compile "org.fusesource.jansi:jansi:$jansiVersion"
-    compile 'io.github.tronprotocol:zksnark-java-sdk:1.0.0'
-    compile 'org.reflections:reflections:0.9.11'
+    api project(":crypto")
+    api "org.fusesource.jansi:jansi:$jansiVersion"
+    api 'io.github.tronprotocol:zksnark-java-sdk:1.0.0'
+    api 'org.reflections:reflections:0.9.11'
 }
 
 
@@ -46,6 +44,7 @@ jacoco {
 }
 
 jacocoTestReport {
+    dependsOn(processResources)  // explicit_dependency
     reports {
         xml.enabled = true
         html.enabled = true

common/build.gradle

@@ -30,30 +30,30 @@ if (isWindows()) {
 }
 
 dependencies {
-    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.13.4.1'
-    compile "com.cedarsoftware:java-util:1.8.0"
-    compile group: 'org.apache.httpcomponents', name: 'httpasyncclient', version: '4.1.1'
-    compile group: 'commons-codec', name: 'commons-codec', version: '1.11'
-    compile group: 'com.beust', name: 'jcommander', version: '1.72'
-    compile group: 'com.typesafe', name: 'config', version: '1.3.2'
-    compile group: leveldbGroup, name: leveldbName, version: leveldbVersion
-    compile group: 'org.rocksdb', name: 'rocksdbjni', version: '5.15.10'
+    api group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.13.4.2' // https://github.com/advisories/GHSA-jjjh-jjxp-wpff https://github.com/FasterXML/jackson-databind/issues/3627
+    api "com.cedarsoftware:java-util:1.8.0"
+    api group: 'org.apache.httpcomponents', name: 'httpasyncclient', version: '4.1.1'
+    api group: 'commons-codec', name: 'commons-codec', version: '1.11'
+    api group: 'com.beust', name: 'jcommander', version: '1.72'
+    api group: 'com.typesafe', name: 'config', version: '1.3.2'
+    api group: leveldbGroup, name: leveldbName, version: leveldbVersion
+    api group: 'org.rocksdb', name: 'rocksdbjni', version: '5.15.10'
     // https://mvnrepository.com/artifact/org.quartz-scheduler/quartz
-    compile group: 'org.quartz-scheduler', name: 'quartz', version: '2.3.2'
-    compile group: 'io.prometheus', name: 'simpleclient', version: '0.15.0'
-    compile group: 'io.prometheus', name: 'simpleclient_httpserver', version: '0.15.0'
-    compile group: 'io.prometheus', name: 'simpleclient_hotspot', version: '0.15.0'
-    compile 'org.aspectj:aspectjrt:1.8.13'
-    compile 'org.aspectj:aspectjweaver:1.8.13'
-    compile 'org.aspectj:aspectjtools:1.8.13'
-    compile group: 'io.github.tronprotocol', name: 'libp2p', version: '2.2.1',{
+    api group: 'org.quartz-scheduler', name: 'quartz', version: '2.3.2'
+    api group: 'io.prometheus', name: 'simpleclient', version: '0.15.0'
+    api group: 'io.prometheus', name: 'simpleclient_httpserver', version: '0.15.0'
+    api group: 'io.prometheus', name: 'simpleclient_hotspot', version: '0.15.0'
+    api 'org.aspectj:aspectjrt:1.8.13'
+    api 'org.aspectj:aspectjweaver:1.8.13'
+    api 'org.aspectj:aspectjtools:1.8.13'
+    api group: 'io.github.tronprotocol', name: 'libp2p', version: '2.2.1',{
         exclude group: 'io.grpc', module: 'grpc-context'
         exclude group: 'io.grpc', module: 'grpc-core'
         exclude group: 'io.grpc', module: 'grpc-netty'
         exclude group: 'com.google.protobuf', module: 'protobuf-java'
         exclude group: 'com.google.protobuf', module: 'protobuf-java-util'
     }
-    compile project(":protocol")
+    api project(":protocol")
 }
 
 jacocoTestReport {

consensus/build.gradle

@@ -1,8 +1,7 @@
 description = "consensus – a distributed consensus arithmetic for blockchain."
 
 dependencies {
-    compile project(":chainbase")
-    compile project(":protocol")
+    api project(":chainbase")
 }
 
 test {

crypto/build.gradle

@@ -11,7 +11,7 @@ repositories {
 }
 
 dependencies {
-    compile project(":common")
+    api project(":common")
 }
 
 jacocoTestReport {

example/actuator-example/build.gradle

@@ -1,6 +1,6 @@
 description = "actuator-example – a example of actuator."
 
 dependencies {
-    compile project(":actuator")
+    api project(":actuator")
 }
 

framework/build.gradle

@@ -38,38 +38,36 @@ task version(type: Exec) {
 
 dependencies {
     //local libraries
-    compile fileTree(dir: 'libs', include: '*.jar')
+    implementation fileTree(dir: 'libs', include: '*.jar')
     // end local libraries
-    testCompile group: 'org.hamcrest', name: 'hamcrest-junit', version: '1.0.0.1'
-    testCompile group: 'com.github.stefanbirkner', name: 'system-rules', version: '1.16.0'
+    testImplementation group: 'org.hamcrest', name: 'hamcrest-junit', version: '1.0.0.1'
+    testImplementation group: 'com.github.stefanbirkner', name: 'system-rules', version: '1.16.0'
 
-    compile group: 'com.google.inject', name: 'guice', version: '4.1.0'
-    compile group: 'io.dropwizard.metrics', name: 'metrics-core', version: '3.1.2'
-    compile group: 'com.github.davidb', name: 'metrics-influxdb', version: '0.8.2'
-    compile group: 'com.carrotsearch', name: 'java-sizeof', version: '0.0.5'
+    implementation group: 'com.google.inject', name: 'guice', version: '4.1.0'
+    implementation group: 'io.dropwizard.metrics', name: 'metrics-core', version: '3.1.2'
+    implementation group: 'com.github.davidb', name: 'metrics-influxdb', version: '0.8.2'
+    implementation group: 'com.carrotsearch', name: 'java-sizeof', version: '0.0.5'
     // http
-    compile 'org.eclipse.jetty:jetty-server:9.4.53.v20231009'
-    compile 'org.eclipse.jetty:jetty-servlet:9.4.53.v20231009'
-    compile 'com.alibaba:fastjson:1.2.83'
+    implementation 'org.eclipse.jetty:jetty-server:9.4.53.v20231009'
+    implementation 'org.eclipse.jetty:jetty-servlet:9.4.53.v20231009'
+    implementation 'com.alibaba:fastjson:1.2.83'
     // end http
 
     // https://mvnrepository.com/artifact/com.github.briandilley.jsonrpc4j/jsonrpc4j
-    compile group: 'com.github.briandilley.jsonrpc4j', name: 'jsonrpc4j', version: '1.6'
+    implementation group: 'com.github.briandilley.jsonrpc4j', name: 'jsonrpc4j', version: '1.6'
 
     // https://mvnrepository.com/artifact/javax.portlet/portlet-api
     compileOnly group: 'javax.portlet', name: 'portlet-api', version: '3.0.1'
 
-    compile "io.vavr:vavr:0.9.2"
-    compile group: 'org.pf4j', name: 'pf4j', version: '2.5.0'
+    implementation "io.vavr:vavr:0.9.2"
+    implementation group: 'org.pf4j', name: 'pf4j', version: '2.5.0'
 
     testImplementation group: 'org.springframework', name: 'spring-test', version: '5.2.0.RELEASE'
     testImplementation group: 'org.springframework', name: 'spring-web', version: '5.2.0.RELEASE'
 
-    compile group: 'org.zeromq', name: 'jeromq', version: '0.5.3'
-    compile project(":chainbase")
-    compile project(":protocol")
-    compile project(":actuator")
-    compile project(":consensus")
+    implementation group: 'org.zeromq', name: 'jeromq', version: '0.5.3'
+    api project(":actuator")
+    api project(":consensus")
 }
 
 check.dependsOn 'lint'
@@ -152,9 +150,11 @@ def binaryRelease(taskName, jarName, mainClass) {
         from(sourceSets.main.output) {
             include "/**"
         }
-
+        // explicit_dependency
+        dependsOn (project(':actuator').jar, project(':consensus').jar, project(':chainbase').jar,
+                project(':crypto').jar, project(':common').jar, project(':protocol').jar)
         from {
-            configurations.compile.collect {
+            configurations.runtimeClasspath.collect {
                 it.isDirectory() ? it : zipTree(it)
             }
         }
@@ -179,7 +179,7 @@ def createScript(project, mainClass, name) {
         outputDir = new File(project.buildDir, 'scripts')
         mainClassName = mainClass
         applicationName = name
-        classpath = project.tasks[JavaPlugin.JAR_TASK_NAME].outputs.files + project.configurations.runtime
+        classpath = project.tasks[JavaPlugin.JAR_TASK_NAME].outputs.files + project.configurations.runtimeClasspath
 //        defaultJvmOpts = ['-XX:+UseConcMarkSweepGC',
 //                          '-XX:+PrintGCDetails',
 //                          '-Xloggc:./gc.log',