No need of git-client as dependency it is only a server :)

[olamy]

Signed-off-by: Olivier Lamy olamy@apache.org

Testing done

Submitter checklist

Edit tasklist title

Beta Give feedback Tasklist Submitter checklist, more options

• Rename
• Copy markdown
• Delete tasklist

Delete tasklist

Delete tasklist block?

Are you sure? All relationships in this tasklist will be removed.

Cancel Delete

1. Make sure you are opening from a **topic/feature/bugfix branch** (right side) and not your main branch!

   Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove
2. Ensure that the pull request title represents the desired changelog entry

   Ensure that the pull request title represents the desired changelog entry
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove
3. Please describe what you did

   Please describe what you did
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove
4. Link to relevant issues in GitHub or Jira

   Link to relevant issues in GitHub or Jira
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove
5. Link to relevant pull requests, esp. upstream and downstream changes

   Link to relevant pull requests, esp. upstream and downstream changes
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove
6. Ensure you have provided tests - that demonstrates feature works or fixes the issue

   Ensure you have provided tests - that demonstrates feature works or fixes the issue
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove

Add item to Submitter checklist

[jglick]

This does not seem like a good idea. Controllers with both plugins installed would then have two copies of JGit. And we would need to issue releases of both plugins in response to security advisories.

What is the motivation here? git-client has no GUI so should be a harmless dependency.

[olamy]

This does not seem like a good idea. Controllers with both plugins installed would then have two copies of JGit. And we would need to issue releases of both plugins in response to security advisories.

What is the motivation here? git-client has no GUI so should be a harmless dependency.

with a Maven POV using a dependency only because you need something transitive from it looks totally wrong and means you do not have any control on the dependencies.
Actually with such dependency, you end up having an old git-client dependency in git-client during test. I was changing few things there and I didn't understand why tests were still working despite I made big changes when I realised "ditto this project depends on itself but older version"

mvn dependency:analyze

[INFO] --- dependency:3.6.1:analyze (default-cli) @ git-server ---
[WARNING] Used undeclared dependencies found:
[WARNING]    org.eclipse.jgit:org.eclipse.jgit:jar:6.5.0.202303070854-r:compile
[WARNING]    org.kohsuke.stapler:stapler:jar:1711.1713.vc400cfb_5597a_:provided
[WARNING]    commons-io:commons-io:jar:2.11.0:provided
[WARNING]    org.eclipse.jgit:org.eclipse.jgit.http.server:jar:6.5.0.202303070854-r:compile
[WARNING]    org.hamcrest:hamcrest:jar:2.2:test
[WARNING]    args4j:args4j:jar:2.33:provided
[WARNING]    junit:junit:jar:4.13.2:test
[WARNING]    org.apache.sshd:sshd-common:jar:2.10.0:compile
[WARNING]    org.jenkins-ci.main:remoting:jar:3044.vb_940a_a_e4f72e:provided
[WARNING]    org.apache.sshd:sshd-core:jar:2.10.0:compile
[WARNING] Unused declared dependencies found:
[WARNING]    org.jenkins-ci.modules:instance-identity:jar:142.v04572ca_5b_265:compile
[WARNING]    org.jenkins-ci.plugins:git-client:jar:4.2.0:compile
[WARNING]    org.jenkins-ci.main:jenkins-war:executable-war:2.361.4:test
[WARNING]    commons-logging:commons-logging:jar:1.2:provided
[WARNING]    org.jenkins-ci:test-annotations:jar:1.4:test
[WARNING]    org.junit.jupiter:junit-jupiter:jar:5.10.2:test
[WARNING]    org.junit.vintage:junit-vintage-engine:jar:5.10.2:test
[WARNING] Non-test scoped test only dependencies found:

the solution maybe is to have to jgit api plugin

[jglick]

We could have a JGit API plugin I guess. Do any other plugins need JGit? This one is a bit obscure—used mainly by Scriptler.