jar-dependencies 0.5.7 → 0.6.0.pre1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5f808b45045d68ee8f676ae6a217eab596d8f5636e61113b453ee0b6b190f75f
-  data.tar.gz: 5dcec69751d4ebc168be6059e56da74a8c033bff73d895f5cf06051e15fc716d
+  metadata.gz: 47fc2eba6a111bc981e2c73b3762afaa096e9e8e81b6aa9ac062198cb8eb3694
+  data.tar.gz: a67771296a97cbdc4596ea245e72bfde22ebb319c772d37fc0b9e4f210a77568
 SHA512:
-  metadata.gz: 413d8136a728211c7cfe8bffa455f4ac17b4d3eb5cb4eb44e1a08642a56805d3d81698f26be3cb0ee76b972aed0ff748e0f4d1b42fa7030d47e12e676b37fa7b
-  data.tar.gz: f9558c6a6804622b02546b70320709cb945701524e72d1d1e40829af8cdb5e4fa345fa4888f924794d55b46cf1aa508490f06e70345da2a3c6170ebe516854f8
+  metadata.gz: 987de7a7960c938380ff580e629508bcfa35b1e01d843e99e3e98c1f0667eabbd09cd6e05e9668fe0abdb59eacd750c2d69592b637b81af912b1af71989cb69d
+  data.tar.gz: af48da8fd323c6babf5a11ddd28df1fed578a18691fc4cd023be0d1fb84cef8042887c8d6fd18ab830b9435f63df36ca5bdfae6d7a757a1f93a7f930ba0e7c1e

data/Rakefile

@@ -4,6 +4,7 @@ task default: [:specs]
 
 require 'bundler/gem_tasks'
 require 'rubocop/rake_task'
+require 'rake/clean'
 
 RuboCop::RakeTask.new
 
@@ -15,3 +16,47 @@ task :specs do
     require File.basename(f.sub(/.rb$/, ''))
   end
 end
+
+require_relative 'lib/jars/mima/version'
+
+MIMA_VERSION = Jars::Mima::MIMA_VERSION
+SLF4J_VERSION = Jars::Mima::SLF4J_VERSION
+MIMA_JARS = Jars::Mima::JARS
+MIMA_DIR = Jars::Mima::MIMA_DIR
+
+MIMA_JARS.each_key { |jar| CLEAN.include(File.join(MIMA_DIR, jar)) }
+
+desc 'download Mima (and dependent SLF4J) jars'
+task :download_jars do
+  require 'fileutils'
+  require 'open-uri'
+  require 'digest/sha1'
+
+  FileUtils.mkdir_p(MIMA_DIR)
+
+  MIMA_JARS.each do |filename, info|
+    target = File.join(MIMA_DIR, filename)
+    if File.exist?(target)
+      verify_checksum(target, info[:sha1])
+      puts "  exists: #{target}"
+      next
+    end
+
+    puts "  downloading #{filename}..."
+    URI.open(info[:url]) do |remote| # rubocop:disable Security/Open
+      File.open(target, 'wb') { |f| f.write(remote.read) }
+    end
+    verify_checksum(target, info[:sha1])
+    puts "  saved: #{target}"
+  end
+end
+
+def verify_checksum(path, expected_sha1)
+  actual = Digest::SHA1.file(path).hexdigest
+  return if actual == expected_sha1
+
+  File.delete(path)
+  raise "SHA-1 mismatch for #{path}:\n" \
+        "  expected: #{expected_sha1}\n" \
+        "  actual:   #{actual}"
+end

data/Readme.md

@@ -166,8 +166,8 @@ xalan/xerces libraries used by those gems are popular ones in the Java world.
 
 # Troubleshooting
 
-Since maven is used under the hood it is possible to get more insight
-what maven is doing. Show the regular maven output:
+Jar dependency resolution uses the bundled Mima resolver. To get more
+insight into jar-dependencies progress and warnings, enable verbose output:
 
 ```shell
 JARS_VERBOSE=true bundle install
@@ -175,19 +175,14 @@ JARS_VERBOSE=true gem install some_gem
 ```
 
 
-Or, with maven debug enabled
+For Ruby-side debug diagnostics, including backtraces for suppressed setup
+errors and jar loading decisions, enable debug output:
 
 ```shell
 JARS_DEBUG=true bundle install
 JARS_DEBUG=true gem install some_gem
 ```
 
-The maven command line which gets printed needs maven-3.9.x and the
-ruby DSL extension for maven:
-[polyglot-maven
-configuration](https://github.com/takari/polyglot-maven#configuration) where `${maven.multiModuleProjectDirectory}` is
-your current directory.
-
 # Configuration
 
 <table border='1'>
@@ -195,10 +190,10 @@ your current directory.
 <td>ENV</td><td>java system property</td><td>default</td><td>description</td>
 </tr>
 <tr>
-<td><tt>JARS_DEBUG</tt></td><td>jars.debug</td><td>false</td><td>if set to true it will produce lots of debug out (maven -X switch)</td>
+<td><tt>JARS_DEBUG</tt></td><td>jars.debug</td><td>false</td><td>if set to true it will produce Ruby-side debug diagnostics and implies verbose output</td>
 </tr>
 <tr>
-<td><tt>JARS_VERBOSE</tt></td><td>jars.verbose</td><td>false</td><td>if set to true it will produce some extra output</td>
+<td><tt>JARS_VERBOSE</tt></td><td>jars.verbose</td><td>false</td><td>if set to true it will produce some extra resolver output</td>
 </tr>
 <tr>
 <td><tt>JARS_HOME</tt></td><td>jars.home</td><td>$HOME/.m2/repository</td><td>filesystem location where to store the jar files and some metadata</td>

data/jar-dependencies.gemspec

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative 'lib/jars/version'
+require_relative 'lib/jars/mima/version'
 
 Gem::Specification.new do |s|
   s.name = 'jar-dependencies'
@@ -13,11 +14,13 @@ Gem::Specification.new do |s|
   s.homepage = 'https://github.com/jruby/jar-dependencies'
 
   s.bindir = 'exe'
-  s.executables = [lock_jars = 'lock_jars']
+  s.executables = ['lock_jars']
 
   s.license = 'MIT'
 
   s.files = Dir['{lib}/**/*'] + %w[Mavenfile Rakefile Readme.md jar-dependencies.gemspec MIT-LICENSE]
+  # explicitly require the jars
+  s.files += Jars::Mima::JARS.each_key.map {File.join(Jars::Mima::MIMA_DIR, _1)}
 
   s.description = <<~TEXT
     manage jar dependencies for gems and keep track which jar was already
@@ -30,18 +33,6 @@ Gem::Specification.new do |s|
   s.required_ruby_version = '>= 2.6'
 
   s.add_development_dependency 'minitest', '~> 5.10'
-  s.add_development_dependency 'ruby-maven', ruby_maven_version = '~> 3.9'
 
-  s.post_install_message = <<~TEXT
-
-    if you want to use the executable #{lock_jars} then install ruby-maven gem before using #{lock_jars}
-
-      $ gem install ruby-maven -v '#{ruby_maven_version}'
-
-    or add it as a development dependency to your Gemfile
-
-       gem 'ruby-maven', '#{ruby_maven_version}'
-
-  TEXT
   s.metadata['rubygems_mfa_required'] = 'true'
 end

data/lib/jar_dependencies.rb

@@ -22,48 +22,58 @@
 #
 
 module Jars
-  unless defined? Jars::SKIP_LOCK
-    MAVEN_SETTINGS = 'JARS_MAVEN_SETTINGS'
-    LOCAL_MAVEN_REPO = 'JARS_LOCAL_MAVEN_REPO'
-    # lock file to use
-    LOCK = 'JARS_LOCK'
-    # where the locally stored jars are search for or stored
-    HOME = 'JARS_HOME'
-    # skip the gem post install hook
-    SKIP = 'JARS_SKIP'
-    # skip Jars.lock mainly to run lock_jars
-    SKIP_LOCK = 'JARS_SKIP_LOCK'
-    # do not require any jars if set to false
-    REQUIRE = 'JARS_REQUIRE'
-    # @private
-    NO_REQUIRE = 'JARS_NO_REQUIRE'
-    # no more warnings on conflict. this still requires jars but will
-    # not warn. it is needed to load jars from (default) gems which
-    # do contribute to any dependency manager (maven, gradle, jbundler)
-    QUIET = 'JARS_QUIET'
-    # show maven output
-    VERBOSE = 'JARS_VERBOSE'
-    # maven debug
-    DEBUG = 'JARS_DEBUG'
-    # vendor jars inside gem when installing gem
-    VENDOR = 'JARS_VENDOR'
-    # string used when the version is unknown
-    UNKNOWN = 'unknown'
-  end
+  # rubocop:disable Style/RedundantFreeze
+  MAVEN_SETTINGS = 'JARS_MAVEN_SETTINGS'.freeze
+  LOCAL_MAVEN_REPO = 'JARS_LOCAL_MAVEN_REPO'.freeze
+  # lock file to use
+  LOCK = 'JARS_LOCK'.freeze
+  # where the locally stored jars are search for or stored
+  HOME = 'JARS_HOME'.freeze
+  # skip the gem post install hook
+  SKIP = 'JARS_SKIP'.freeze
+  # skip Jars.lock mainly to run lock_jars
+  SKIP_LOCK = 'JARS_SKIP_LOCK'.freeze
+  # do not require any jars if set to false
+  REQUIRE = 'JARS_REQUIRE'.freeze
+  # @private
+  NO_REQUIRE = 'JARS_NO_REQUIRE'.freeze
+  # no more warnings on conflict. this still requires jars but will
+  # not warn. it is needed to load jars from (default) gems which
+  # do contribute to any dependency manager (maven, gradle, jbundler)
+  QUIET = 'JARS_QUIET'.freeze
+  # show resolver output
+  VERBOSE = 'JARS_VERBOSE'.freeze
+  # show jar-dependencies debug output
+  DEBUG = 'JARS_DEBUG'.freeze
+  # vendor jars inside gem when installing gem
+  VENDOR = 'JARS_VENDOR'.freeze
+  # string used when the version is unknown
+  UNKNOWN = 'unknown'.freeze
+  # rubocop:enable Style/RedundantFreeze
 
-  autoload :MavenSettings, 'jars/maven_settings'
   autoload :Classpath, 'jars/classpath'
+  autoload :MavenSettings, 'jars/maven_settings'
+  autoload :Mima, 'jars/mima'
 
   @jars_lock = false
   @jars = {}
 
+  class JarLoadError < LoadError; end
+
   class << self
-    def lock_down(debug: false, verbose: false, **kwargs)
+    def lock_down(debug: nil, verbose: nil, **kwargs)
+      previous_debug = ENV[DEBUG]
+      previous_verbose = ENV[VERBOSE]
+      previous_skip_lock = ENV[SKIP_LOCK]
+      ENV[DEBUG] = debug.to_s unless debug.nil?
+      ENV[VERBOSE] = verbose.to_s unless verbose.nil?
       ENV[SKIP_LOCK] = 'true'
       require 'jars/lock_down' # do this lazy to keep things clean
-      Jars::LockDown.new(debug, verbose).lock_down(kwargs.delete(:vendor_dir), **kwargs)
+      Jars::LockDown.new.lock_down(kwargs.delete(:vendor_dir), **kwargs)
     ensure
-      ENV[SKIP_LOCK] = nil
+      ENV[DEBUG] = previous_debug unless debug.nil?
+      ENV[VERBOSE] = previous_verbose unless verbose.nil?
+      ENV[SKIP_LOCK] = previous_skip_lock
     end
 
     if defined? JRUBY_VERSION
@@ -95,7 +105,7 @@ module Jars
       if @require.nil?
         if (require = to_boolean(REQUIRE)).nil?
           no_require = to_boolean(NO_REQUIRE)
-          @require = no_require.nil? ? true : !no_require
+          @require = no_require.nil? || !no_require
         else
           @require = require
         end
@@ -118,7 +128,8 @@ module Jars
     end
 
     def verbose?
-      to_boolean(VERBOSE)
+      verbose = to_boolean(VERBOSE)
+      verbose.nil? ? debug? : (verbose || !!debug?)
     end
 
     def debug?
@@ -144,12 +155,7 @@ module Jars
     def jars_lock_from_class_loader
       return unless defined?(JRUBY_VERSION)
 
-      if JRuby::Util.respond_to?(:class_loader_resources)
-        JRuby::Util.class_loader_resources('Jars.lock')
-      else
-        require 'jruby'
-        JRuby.runtime.jruby_class_loader.get_resources('Jars.lock').collect(&:to_s)
-      end
+      JRuby::Util.class_loader_resources('Jars.lock')
     end
 
     def lock_path(basedir = nil)
@@ -270,7 +276,7 @@ module Jars
     end
 
     def warn(msg = nil)
-      return if (verbose? == nil && quiet?) || (verbose? == false && !debug?)
+      return if quiet? && !debug?
 
       Kernel.warn(msg || yield)
     end
@@ -328,8 +334,8 @@ module Jars
       local_repo = nil if local_repo.empty? || !File.exist?(local_repo)
       local_repo
     rescue => e
-      Jars.debug(e)
       Jars.warn "error reading or parsing local settings from: #{settings}"
+      Jars.debug(e)
       nil
     end
 
@@ -356,25 +362,26 @@ module Jars
         require jar
       end
     rescue LoadError => e
-      raise "\n\n\tyou might need to reinstall the gem which depends on the " \
-            'missing jar or in case there is Jars.lock then resolve the jars with ' \
-            "`lock_jars` command\n\n#{e.message} (LoadError)"
+      Jars.warn "failed to load jar: #{jar} (#{e.message})"
+      Jars.debug(e)
+      raise JarLoadError, "failed to load jar: #{jar}; run `lock_jars` or reinstall the gem"
     end
   end
 end
 
 def require_jar(*args, &block)
-  return nil unless Jars.require?
+  return unless Jars.require?
 
   result = Jars.require_jar(*args, &block)
   if result.is_a? String
     args << (yield || Jars::UNKNOWN) if args.size == 2 && block
     Jars.warn do
-      "--- jar coordinate #{args[0..-2].join(':')} already loaded with version #{result} - omit version #{args[-1]}"
+      "jar conflict: #{args[0..-2].join(':')} already loaded with version #{result}; " \
+        "skipping requested version #{args[-1]}"
     end
-    Jars.debug { "    try to load from #{caller.join("\n\t")}" }
+    Jars.debug("\n\t#{caller.join("\n\t")}") if Jars.debug?
     return false
   end
-  Jars.debug { "    register #{args.inspect} - #{result == true}" }
+  Jars.debug { "jar registration: #{args.inspect}; loaded=#{result == true}" }
   result
 end

data/lib/jars/gemspec_artifacts.rb

@@ -12,7 +12,7 @@ module Jars
           if low == high
             low
           else
-            super "#{low || '[0'},#{high || ')'}"
+            super("#{low || '[0'},#{high || ')'}")
           end
         end
       end
@@ -26,17 +26,17 @@ module Jars
           ["[#{snapshot_version(val)}", "#{snapshot_version(last)}]"]
         elsif arg.include?('>=')
           val = arg.sub(/>=\s*/, '')
-          ["[#{snapshot_version(val)}", (nil || high)]
+          ["[#{snapshot_version(val)}", high]
         elsif arg.include?('<=')
           val = arg.sub(/<=\s*/, '')
-          [(nil || low), "#{snapshot_version(val)}]"]
-        # treat '!' the same way as '>' since maven can not describe such range
+          [low, "#{snapshot_version(val)}]"]
+        # treat '!' the same way as '>' since maven cannot describe such range
         elsif /[!>]/.match?(arg)
           val = arg.sub(/[!>]\s*/, '')
-          ["(#{snapshot_version(val)}", (nil || high)]
+          ["(#{snapshot_version(val)}", high]
         elsif arg.include?('<')
           val = arg.sub(/<\s*/, '')
-          [(nil || low), "#{snapshot_version(val)})"]
+          [low, "#{snapshot_version(val)})"]
         elsif arg.include?('=')
           val = arg.sub(/=\s*/, '')
           # for prereleased version pick the maven version (no version range)
@@ -133,12 +133,12 @@ module Jars
 
         if /[\[()\]]/.match?(line)
           index = line.index(/[\[(].+$/)
-          version = line[index..].sub(/:/, ', ')
-          line = line[0..index - 1].strip.sub(/:$/, '')
+          version = line[index..].sub(':', ', ')
+          line = line[0..(index - 1)].strip.sub(/:$/, '')
         else
           index = line.index(/:[^:]+$/)
-          version = line[index + 1..]
-          line = line[0..index - 1].strip
+          version = line[(index + 1)..]
+          line = line[0..(index - 1)].strip
         end
 
         case line.count(':')

data/lib/jars/installer.rb

@@ -171,17 +171,18 @@ module Jars
     end
 
     def ruby_maven_install_options=(options)
-      @mvn.ruby_maven_install_options = options
+      # no-op: kept for backward compatibility with post_install_hook
     end
 
     def jars?
       # first look if there are any requirements in the spec
       # and then if gem depends on jar-dependencies for runtime.
       # only then install the jars declared in the requirements
-      result = (spec = self.spec) && !spec.requirements.empty? &&
+      spec = self.spec
+      result = spec && !spec.requirements.empty? &&
                spec.dependencies.detect { |d| d.name == 'jar-dependencies' && d.type == :runtime }
       if result && spec.platform.to_s != 'java'
-        Jars.warn "\njar dependencies found on non-java platform gem - do not install jars\n"
+        Jars.warn "jar-dependencies found on non-java platform gem; skipping jar installation"
         false
       else
         result
@@ -191,21 +192,18 @@ module Jars
     private
 
     def do_install(vendor_dir, write_require_file)
-      if !spec.require_paths.include?(vendor_dir) && vendor_dir
-        raise "vendor dir #{vendor_dir} not in require_paths of gemspec #{spec.require_paths}"
+      require_paths = spec.require_paths
+      if vendor_dir && !require_paths.include?(vendor_dir)
+        raise "vendor dir #{vendor_dir} not in require_paths of gemspec #{require_paths}"
       end
 
       target_dir = File.join(@mvn.basedir, vendor_dir || spec.require_path)
       jars_file = File.join(target_dir, "#{spec.name}_jars.rb")
 
-      # write out new jars_file it write_require_file is true or
-      # check timestamps:
-      # do not generate file if specfile is older then the generated file
-      if !write_require_file &&
-         File.exist?(jars_file) &&
-         File.mtime(@mvn.specfile) < File.mtime(jars_file)
-        # leave jars_file as is
-        jars_file = nil
+      # write out new jars_file if write_require_file is true or check timestamps:
+      # do not generate file if specfile is older than the generated file
+      if !write_require_file && File.exist?(jars_file) && File.mtime(@mvn.specfile) < File.mtime(jars_file)
+        jars_file = nil # leave jars_file as is
       end
       deps = install_dependencies
       self.class.write_require_jars(deps, jars_file)

data/lib/jars/lock.rb

@@ -57,7 +57,7 @@ module Jars
       File.read(@file).each_line do |line|
         next unless /:.+:/.match?(line)
 
-        jar = JarDetails.new(line.strip.sub(/:jar:/, ':').sub(/:$/, ': ').split(':'))
+        jar = JarDetails.new(line.strip.sub(':jar:', ':').sub(/:$/, ': ').split(':'))
         case scope
         when :all, :test
           yield jar

data/lib/jars/lock_down.rb

@@ -1,101 +1,132 @@
 # frozen_string_literal: true
 
-require 'fileutils'
 require 'jar_dependencies'
 require 'jars/version'
-require 'jars/maven_factory'
 require 'jars/gemspec_artifacts'
 
 module Jars
   class LockDown
-    attr_reader :debug, :verbose
-
-    def initialize(debug, verbose)
-      @debug = debug
-      @verbose = verbose
+    def basedir
+      File.expand_path('.')
     end
 
-    def maven_new
-      factory = MavenFactory.new({}, @debug, @verbose)
-      pom = File.expand_path('lock_down_pom.rb', __dir__)
-      m = factory.maven_new(pom)
-      m['jruby.plugins.version'] = Jars::JRUBY_PLUGINS_VERSION
-      m['dependency.plugin.version'] = Jars::DEPENDENCY_PLUGIN_VERSION
-      m['jars.basedir'] = File.expand_path(basedir)
-      jarfile = File.expand_path(Jars.jarfile)
-      m['jars.jarfile'] = jarfile if File.exist?(jarfile)
-      attach_jar_coordinates_from_bundler_dependencies(m)
-      m
-    end
-    private :maven_new
+    def collect_artifacts
+      artifacts = []
+      done = []
 
-    def maven
-      @maven ||= maven_new
-    end
+      attach_jar_coordinates_from_bundler_dependencies(artifacts, done)
 
-    def basedir
-      File.expand_path('.')
+      # Also collect from local gemspec if present
+      specs = Dir['*.gemspec']
+      if specs.size == 1
+        spec = eval(File.read(specs.first), TOPLEVEL_BINDING, specs.first) # rubocop:disable Security/Eval
+        ga = GemspecArtifacts.new(spec)
+        ga.artifacts.each do |a|
+          unless done.include?(a.key)
+            artifacts << a
+            done << a.key
+          end
+        end
+      end
+
+      artifacts
     end
+    private :collect_artifacts
 
-    def attach_jar_coordinates_from_bundler_dependencies(maven)
+    def attach_jar_coordinates_from_bundler_dependencies(artifacts, done)
       load_path = $LOAD_PATH.dup
       require 'bundler'
       # TODO: make this group a commandline option
       Bundler.setup('default')
-      maven.property('jars.bundler', true)
       cwd = File.expand_path('.')
-      Gem.loaded_specs.each do |_name, spec|
-        # if gemspec is local then include all dependencies
-        maven.attach_jars(spec, all_dependencies: cwd == spec.full_gem_path)
+      Gem.loaded_specs.each_value do |spec|
+        all = cwd == spec.full_gem_path # if gemspec is local then include all dependencies
+        ga = GemspecArtifacts.new(spec)
+        ga.artifacts.each do |a|
+          next if done.include?(a.key)
+          next unless all || (a.scope != 'provided' && a.scope != 'test')
+
+          artifacts << a
+          done << a.key
+        end
       end
     rescue LoadError => e
-      if Jars.verbose?
-        warn e.message
-        warn 'no bundler found - ignore Gemfile if exists'
-      end
+      Jars.warn "bundler unavailable (#{e.message}); skipping dependency discovery" if Jars.verbose?
     rescue Bundler::GemfileNotFound
-    # do nothing then as we have bundler but no Gemfile
+      # bundler is available, but there is no Gemfile to inspect
     rescue Bundler::GemNotFound
-      warn "can not setup bundler with #{Bundler.default_lockfile}"
+      Jars.warn "cannot set up bundler with #{Bundler.default_lockfile}"
       raise
     ensure
       $LOAD_PATH.replace(load_path)
     end
 
-    def lock_down(vendor_dir = nil, force: false, update: false, tree: nil)
-      out = File.expand_path('.jars.output')
-      tree_provided = tree
-      tree ||= File.expand_path('.jars.tree')
-      maven.property('jars.outputFile', out)
-      maven.property('maven.repo.local', Jars.local_maven_repo)
-      maven.property('jars.home', File.expand_path(vendor_dir)) if vendor_dir
-      maven.property('jars.lock', File.expand_path(Jars.lock))
-      maven.property('jars.force', force)
-      maven.property('jars.update', update) if update
-      # tell not to use Jars.lock as part of POM when running mvn
-      maven.property('jars.skip.lock', true)
-
-      args = ['gem:jars-lock']
-      args += ['dependency:tree', '-P -gemfile.lock', "-DoutputFile=#{tree}"] if tree_provided
+    def lock_down(vendor_dir = nil, force: false, update: false, tree: nil) # rubocop:disable Lint/UnusedMethodArgument
+      lock_file = File.expand_path(Jars.lock)
+
+      if !force && File.exist?(lock_file)
+        puts 'Jars.lock already exists, use --force to overwrite'
+        return
+      end
+
+      artifacts = collect_artifacts
+
+      if artifacts.empty?
+        puts 'no jar dependencies found'
+        return
+      end
 
       puts
       puts '-- jar root dependencies --'
       puts
-      status = maven.exec(*args)
-      exit 1 unless status
-      if File.exist?(tree)
+      artifacts.each do |a|
+        puts "      #{a.to_gacv}:#{a.scope || 'compile'}"
+        puts "          exclusions: #{a.exclusions}" if a.exclusions && !a.exclusions.empty?
+      end
+
+      context = Jars::Mima.create_context
+      begin
+        resolved = Jars::Mima.resolve_with_context(context, artifacts, all_dependencies: true)
+      ensure
+        context.close
+      end
+
+      # Write Jars.lock
+      File.open(lock_file, 'w') do |f|
+        resolved.each do |dep|
+          next unless dep.type == 'jar'
+
+          f.puts dep.to_lock_entry
+        end
+      end
+
+      # Optionally vendor jars
+      if vendor_dir
+        require 'fileutils'
+        vendor_path = File.expand_path(vendor_dir)
+        resolved.each do |dep|
+          next unless dep.type == 'jar' && dep.runtime? && !dep.system?
+
+          target = File.join(vendor_path, dep.jar_path)
+          FileUtils.mkdir_p(File.dirname(target))
+          FileUtils.cp(dep.file, target)
+        end
+      end
+
+      if tree
         puts
         puts '-- jar dependency tree --'
         puts
-        puts File.read(tree)
+        resolved.each do |dep|
+          prefix = dep.classifier ? "#{dep.classifier}:" : ''
+          puts "   #{dep.group_id}:#{dep.artifact_id}:#{prefix}#{dep.version}:#{dep.scope}"
+        end
         puts
       end
+
       puts
-      puts File.read(out).gsub("#{File.dirname(out)}/", '')
+      puts File.read(lock_file)
       puts
-    ensure
-      FileUtils.rm_f out
-      FileUtils.rm_f tree
     end
   end
 end