Configure maven to package fat jar without unpacking dependencies in a vertx project, like spring boot does

Question

How can I tell maven to include dependency jar files while building a fat jar, rather than unpacking them to .class files?

I have a vertx 3.6.0 project producing a fat jar. I am using vertx-maven-plugin:1.0.13, and I run mvn clean package to build. In order to take advantage of Veracode SCM (static scanning), the dependencies inside my fat jar have to be intact, meaning the original dependency jar files have to be contained inside my fat jar. Maven is unpacking all dependencies though, so all I have are class files.

We have another spring boot project which works as expected. It seems the final spring boot repackage goal puts all the dependency jar files in the BOOT-INF dir inside the jar file.

Final 2 goals using vertx-maven-plugin:
maven-jar-plugin:2.4:jar
vertx-maven-plugin:1.0.13:package

Final 2 goals using spring-boot-maven-plugin:
maven-jar-plugin:2.4:jar
spring-boot-maven-plugin:2.1.2.RELEASE:repackage

I've searched the docs for vertx-maven-plugin and all over https://maven.apache.org and elsewhere without any luck so far.

Is there a way to get this same repackage behavior for a non spring boot app?

Answer 1

You can't do that with Vert.x because it doesn't do fancy classloading.

But since it's embeddable, you can create a SpringBoot app that just starts Vert.x. Then you'll get your dependency scanner working.

But I would first check with Veracode if it' can't inspect your POM or Gradle build file instead of scanning a JAR.

Answer 2

If your packaging requirement is for the veracode scan piece, you would probably try packaging your project artifacts into a tar, or zip using the maven-assembly plugin. Veracode couldn't scan a dependency jar inside another jar for a non-spring boot project. So, you can try one of the following. i) tar packaging using maven-assembler plugin, or ii) convert it to spring-boot project if thats simpler and you could ,or iii) uber-jar creation using maven-shade plugin and need to make some configuration changes for not getting unpackaged to .class files. Still would suggest you can explore with the tar packaging option - (reference:) https://maven.apache.org/plugins/maven-assembly-plugin/