Proper way to produce fourth party dependency list

[jingyuanli001]

Hi Community,
I'm using the opentelemetry in my project and I would like to generate a full transitive list of runtime dependencies of opentelemetry api and sdk. I tried with some gradle commands to produce the runtime classpath, and I got some results like those

+--- project :api:all
| --- project :context
+--- project :sdk:common
| +--- project :api:all ()
| --- project :semconv
| --- project :api:all ()
--- project :dependencyManagement
+--- com.fasterxml.jackson:jackson-bom:{strictly 2.14.2} -> 2.14.2
+--- com.google.guava:guava-bom:{strictly 31.1-jre} -> 31.1-jre
+--- com.google.protobuf:protobuf-bom:{strictly 3.21.12} -> 3.21.12
+--- com.linecorp.armeria:armeria-bom:{strictly 1.22.1} -> 1.22.1
+--- com.squareup.okhttp3:okhttp-bom:{strictly 4.10.0} -> 4.10.0
+--- com.squareup.okio:okio-bom:{strictly 3.3.0} -> 3.3.0
+--- io.grpc:grpc-bom:{strictly 1.53.0} -> 1.53.0
+--- io.netty:netty-bom:{strictly 4.1.89.Final} -> 4.1.89.Final
+--- io.zipkin.brave:brave-bom:{strictly 5.15.0} -> 5.15.0
+--- io.zipkin.reporter2:zipkin-reporter-bom:{strictly 2.16.3} -> 2.16.3
+--- org.assertj:assertj-bom:{strictly 3.24.2} -> 3.24.2
+--- org.junit:junit-bom:{strictly 5.9.2} -> 5.9.2
+--- org.testcontainers:testcontainers-bom:{strictly 1.17.6} -> 1.17.6
--- org.snakeyaml:snakeyaml-engine:{strictly 2.6} -> 2.6

While this command does gives me some information about the fourth party dependencies used in opentelemetry, they are mostly bom files of the project and they didn't provide any information about the specific components used in opentelemetry.
Is there a way to figure out the specific component used in opentelemetry?

I see there is another discussion about this issue #3187 but the gradlew command output from that discussion seems to be quite different from mine, so I started this discussion.

[jkwatson]

what gradle command are you running? What modules are you trying to understand dependencies for?

[jingyuanli001]

So I'm trying to understand the dependencies for opentelemetry-api and opentelemetry-sdk. The gradle commands I use follow the format of
./gradlew submodulename:dependencies

[jkwatson]

have you tried including --configuration compileClasspath like in the referenced discussion?

[jingyuanli001]

so when I add the configuration I got the results like below, but those results only show the BOM files but is not the actual jar files used in the project

+--- project :api:all
+--- project :sdk:common
| +--- project :api:all
| --- project :semconv
| --- project :api:all
--- project :dependencyManagement
+--- com.fasterxml.jackson:jackson-bom:{strictly 2.14.2} -> 2.14.2
+--- com.google.guava:guava-bom:{strictly 31.1-jre} -> 31.1-jre
+--- com.google.protobuf:protobuf-bom:{strictly 3.21.12} -> 3.21.12
+--- com.linecorp.armeria:armeria-bom:{strictly 1.22.1} -> 1.22.1
+--- com.squareup.okhttp3:okhttp-bom:{strictly 4.10.0} -> 4.10.0
+--- com.squareup.okio:okio-bom:{strictly 3.3.0} -> 3.3.0
+--- io.grpc:grpc-bom:{strictly 1.53.0} -> 1.53.0
+--- io.netty:netty-bom:{strictly 4.1.89.Final} -> 4.1.89.Final
+--- io.zipkin.brave:brave-bom:{strictly 5.15.0} -> 5.15.0
+--- io.zipkin.reporter2:zipkin-reporter-bom:{strictly 2.16.3} -> 2.16.3
+--- org.assertj:assertj-bom:{strictly 3.24.2} -> 3.24.2
+--- org.junit:junit-bom:{strictly 5.9.2} -> 5.9.2
+--- org.testcontainers:testcontainers-bom:{strictly 1.17.6} -> 1.17.6
--- org.snakeyaml:snakeyaml-engine:{strictly 2.6} -> 2.6

[jkwatson]

If you ignore the dependencyManagement project dependency, I think you get the right list of dependencies with that command.
The api really doesn't depend on much of anything, on purpose. Just the context. And the context has no external dependencies, either.

We intentionally keep the dependencies extremely lean, so you won't see much from this, unless you start digging into specific exporters that have other dependencies.