Bazel Maven Repository Release 2.0.0 Alpha 2

Note: Alpha release - see planned features and known issues

A mechanism for importing maven-based artifacts into a bazel build (an alternative to rules_jvm_external).

Bazel Maven Repository 2.0 uses a custom built download agent (Kramer, named for the archeologist Carol Kramer) and based on [Maven Archeologist] to quickly resolve and download maven metadata and construct a local bazel workspace representing that repository.

Features

• Single specification of a list of artifacts representing the "universe" (one-version per maven workspace)
• Caching via the standard maven ~/.m2/repository
  • md5 and sha1 hashes are checked for all files, per maven repository model resolution
  • sha256 hashes also checked on artifacts if given in the configuration)
  • artifacts without a sha256 hash must be listed as "insecure": True in the artifact config.
• Generates a bazel package path per maven groupId, and a target per artifactId
• Auto-computes of inter-artifact dependencies (from maven metadata)
  • supports configured (not detected) dependency exclusions
• Substitution of build-snippets (for wiring up dagger, etc.)
• Supports multiple maven repositories
• Supports jar, bundle and aar packaging
• Supports jetifier for android projects
• Tested with java and kotlin rules, including test rules.
• per-artifact build-snippet substitution (e.g. to wire in annotation processors, or fix mis-specified deps)
• per-groupId dependency target substitution (to fix internal build cycles created by build snippet substitution)
• Downloads (if available) source-jars and propagates them for IDEs to pick up.
• Tested against java, kotlin, and android projects.

Key improvements from 1.x

• Performance - 2.x (via kramer) performs highly-parallelized fetches and makes use of caching.
  Local developer rebuilds of the workspace (if artifacts are cached in ~/.m2/repository) are sub-second
  for anything under ~350 artifacts. Time required is technically linear but effectively trivial per artifact.
  At square, we regularly resolve 500+ artifacts in about 1.5 seconds on our developer laptops, and <10s
  on less powerful cloud CI workers (the workers don't get cache hits)
• Jetifier and dependency exclusions (from 1.2.x, but that was a short-lived release, so worth mentioning)
• Source jar support
• Improved appearance in Intellij's External Libraries list.
• In later alphas and betas:
  • Snapshot (sort of - available but frozen because of bazel hermeticity requirements) versions
  • multiple-workspaces

Planned features.

• SNAPSHOT dependencies (pending 2.0 release)
• multiple maven_repository_spec() calls (pending 2.0 release)

Known limitations

• Does not honor in-POM dependency excludes. In short, it can't. It builds a holistic view of the
  repository space, and excludes defined in maven poms trim transitive dependencies.

Known limitations in this alpha:

• Unspecified transitive closure:
  • Doesn't auto-download transitive dependencies not specified in the version list (under discussion)
  • version pin dictionary is in .bzl and given to the rule via starlark - this probably will remain to avoid
    failing to re-build the repository workspace on a version pin list change, but better examples and
    patterns and tool support are pending.

This release is very similar to the 1.0 release, with some additional features. Mostly it is radically faster, and it should be easier to iterate on future features.

Please see the README.md for usage instructions and examples of the above features.