enable to use PEM feature without nanojson nor tomitribe-util

[rmannibucau]

Goal to use it "dep free" is to lighten integrations but also make it more shebang/jshell friendly in scripts (less deps = less setup).

[dblevins]

Hey @rmannibucau checkout the new groupId and artifactId, these don't have dependencies on nanojson or tomitribe-util

• https://repo1.maven.org/maven2/io/churchkey/churchkey/1.19/churchkey-1.19.pom

[rmannibucau]

Any hope we get it without cheating with the shade + get the test in to ensure it is a feature of the deliverable?

[dblevins]

Use of the shade plugin was intentional as to avoid forking of the related code, the JSON parser in particular. Note this PR does not address the JSON parser. On the test are you referring to something in the PR or something yet to be written?

[rmannibucau]

This pr guarantees pem supports works without nanojson and tomitribe-util (and the shade) and harness it by running pem tests (disabling jwk related ones).
Shade should likely be disabled in favor of a classified version (or the default artifact should be "classified") to fully solve my issue, ill let you pick one you like ;).

Side note: ideally I think using a spi - hopefully not hardcoded to enable to use cdi or a serviceloader in standalone - and make indep modules to solve the dep more elegantly and explicitly would be the best but it sounded too intrusive so I just ensured my cases were running without deps and harnessed it by test execution on the ci.

[dblevins]

What is the issue you're facing?

[rmannibucau]

• control deps
• ensure decurity scanning tools work (no shade :()
• ensure useless classes cant be scanned at build and at runtime
• (Not yet fully covered) reduce delivery/patch size (incremental updates)

[dblevins]

This PR doesn't do those things. The shaded libraries are still there in the final jar, including tomitribe-util and nanojson. This PR creates the same shaded jar, but is 4k larger due to the new code. It looks like tomitribe-util could be removed with this PR, but the dependency on nanojson wasn't addressed.

As mentioned the shade work was done very recently and I did consider copying the source code, but opted not to as it then tends to never get updated. I'd like to be able to easily get updates on the JSON parser when they're released without having to copy/paste them. The shading was setup to only bring in the classes needed so there isn't any useless code from unused classes.

I'd prefer to leave it as-is for now if that's ok.

[rmannibucau]

It is David, only it does not do is to remove/classify the shade but rest is done. Only thing needed is to merge to enable github workflow. Check out the yaml.