d2j-base-cmd and d2j-jasminMissing POM preventing build

[will-leeson]

I'm building a project with Soot-Up as a dependency and I'm getting a warning saying

[WARNING] Missing POM for com.github.ThexXTURBOXx.dex2jar:d2j-base-cmd:jar:v61
[WARNING] Missing POM for com.github.ThexXTURBOXx.dex2jar:d2j-jasmin:jar:v61

Then I get the error:

 Failed to create assembly: Error creating assembly archive jar-with-dependencies: /path/to/.m2/repository/com/github/ThexXTURBOXx/dex2jar/d2j-base-cmd/v61/d2j-base-cmd-v61.jar

The file "d2j-base-cmd-v61.jar.lastUpdated" exists at this location. Is there something wrong with this dependency?

[gugia]

I got the same issue with SootUp 1.1.2, which #623 said it's fixed. Please check it out.
Could not resolve dependencies for project org.example:jazzer:jar:1.0-SNAPSHOT: Failed to collect dependencies at org.soot-oss:sootup.java.bytecode:jar:1.1.2 -> com.github.ThexXTURBOXx.dex2jar:dex-tools:jar:v61 -> com.github.ThexXTURBOXx.dex2jar:dex-translator:jar:v61 -> com.github.ThexXTURBOXx.dex2jar:d2j-base-cmd:jar:v61

[JonasKlauke]

The dependency seems to have disappeared from maven central. I can only find v57 but dex2jars GitHub lists v64 as released version.

We are working on another way to transform dex to jimple, to resolve these problems around dex2jar.

As a workaround you could download the dex2jar version yourself.
https://github.com/ThexXTURBOXx/dex2jar/releases/tag/v64

[jpstotz]

The used Dex2Jar version was never on Maven central. It is used in SootUp via https://jitpack.io "repository" which generates the artifacts on-the-fly from the Github project.

[JonasKlauke]

Thanks for the correction. I did not work on the dex2jar problem, I only know that we decided to go for an approach without dex2jar 😅

[swissiety]

API_ASSIST had the dependency problem as well. We guessed it was a problem with the jitpack integration and included the sourcecode of the dex2jar repo via gradle and compiled it ourselves..
@kadirayk maybe we can seperate that annoying dependency into a seperate sootup module?

[ThexXTURBOXx]

Hey there, I got a bug report regarding a similar problem in my dex2jar fork. Might it make your lives easier if I publish dex2jar releases to GitHub packages instead?

[JonasKlauke]

First of all, thanks for further maintaining dex2jar. We switched to your release, but we had to use Jitpack to access your releases. But sometimes Jitpack seems to not provide previously successfully requested releases or sometimes Maven does not use Jitpack to look up the dependencies. So yes if you would publish a version on GitHub packages, we don't need Jitpack to provide us with fresh builds. That will hopefully fix the issues in the lookup of your releases. That could really help us in the time before we will release the new Android frontend that creates Jimple directly from Dex.

[ThexXTURBOXx]

You're more than welcome, I'm glad that I can help!

I am thinking about whether it makes sense to publish it to Maven Central instead.
GitHub packages need authentication details (special configuration of your Maven installation) in order to fetch builds.
I would guess Maven Central is the easiest way for users to fetch the builds.
I will try to get that working and let you know when I am done!
Hence, I will also transform my build numbers to kind-of-SemVer: the patch version will be just the build number.
Maybe, I will overthink that again, but in the meantime this is probably the easiest way to automate publishing the builds to Maven Central using the current GitHub actions workflow.

[JonasKlauke]

yeah the easiest solution would be publishing directly on Maven. If you publish on Git Packages, we have to configure the repository to grab the dependency which could introduce some problems again.

[ThexXTURBOXx]

News: https://repo.maven.apache.org/maven2/de/femtopedia/dex2jar/ ;)
Only caveat for now: If you want to use this, you need to declare a dependency on each module you need independently.
I am planning to introduce a "master module" which includes a dependency on all the other ones, however.
I will let you know when this has also been published.