[MENFORCER-414] Architecture-specific versions of library wrongly flagged by dependency convergence rule

[jira-importer]

Vladimir B opened MENFORCER-414 and commented

I get the following warning reported by the dependency convergence rule of the plugin:

Dependency convergence error for io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile paths to dependency are:
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-com.twitter:finagle-http2_2.12:jar:22.2.0:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:linux-x86_64:2.0.48.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:linux-aarch_64:2.0.48.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:osx-x86_64:2.0.48.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:osx-aarch_64:2.0.48.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:windows-x86_64:2.0.48.Final:compile

It seems that the conflicting library is seen as being the same for all the paths, while in fact there are architecture-specific versions of the same library, which shouldn't be treated as the same library in my opinion.

---

Affects: 3.0.0