如何从 Gradle 中的依赖项中排除内部 package（不是 maven 依赖项）

Question

My project is a spring boot project and it has a dependency which is dexkiller , however the dexkiller rely on soot-infoflow-cmd-jar-with-dependencies which internally uses slf4j while my spring boot project used slf4j as well.
Thus making the following error when I run up my project.
The error is:

SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/Users/user/.gradle/caches/modules-2/files-2.1/de.tud.sse/soot-infoflow-cmd-jar-with-dependencies/1.0/75ee1aee22aee20d41153e43b16b874caa927d2c/soot-infoflow-cmd-jar-with-dependencies-1.0.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/Users/user/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-classic/1.2.3/7c4f3c474fb2c041d8028740440937705ebb473a/logback-classic-1.2.3.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [org.slf4j.impl.SimpleLoggerFactory]
Exception in thread "main" java.lang.IllegalArgumentException: LoggerFactory is not a Logback LoggerContext but Logback is on the classpath. Either remove Logback or the competing implementation (class org.slf4j.impl.SimpleLoggerFactory loaded from file:/Users/user/.gradle/caches/modules-2/files-2.1/de.tud.sse/soot-infoflow-cmd-jar-with-dependencies/1.0/75ee1aee22aee20d41153e43b16b874caa927d2c/soot-infoflow-cmd-jar-with-dependencies-1.0.jar). If you are using WebLogic you will need to add 'org.slf4j' to prefer-application-packages in WEB-INF/weblogic.xml: org.slf4j.impl.SimpleLoggerFactory
    at org.springframework.util.Assert.instanceCheckFailed(Assert.java:655)
    at org.springframework.util.Assert.isInstanceOf(Assert.java:555)
    at org.springframework.boot.logging.logback.LogbackLoggingSystem.getLoggerContext(LogbackLoggingSystem.java:280)
    at org.springframework.boot.logging.logback.LogbackLoggingSystem.beforeInitialize(LogbackLoggingSystem.java:104)
    at org.springframework.boot.context.logging.LoggingApplicationListener.onApplicationStartingEvent(LoggingApplicationListener.java:219)
    at org.springframework.boot.context.logging.LoggingApplicationListener.onApplicationEvent(LoggingApplicationListener.java:200)
    at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:172)
    at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:165)
    at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:139)
    at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:127)
    at org.springframework.boot.context.event.EventPublishingRunListener.starting(EventPublishingRunListener.java:70)
    at org.springframework.boot.SpringApplicationRunListeners.starting(SpringApplicationRunListeners.java:47)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:302)

The dependency tree is like below(soot* jars from my nexus repo):

+--- com.mywork:dexkiller:1.3.1-SNAPSHOT
|    +--- commons-collections:commons-collections:3.2
|    +--- cde.tud.sse:soot-infoflow-cmd-jar-with-dependencies:2.7
|    \--- cde.tud.sse:soot-infoflow-summaries-classes:2.7

Extracted files from soot-infoflow-cmd-jar-with-dependencies.jar

I've tried to exclude the slf4j from dexkiller, but not work.

dependencies {
    compile ('com.mywork:dexkiller:1.3.1-SNAPSHOT'){
            // tried both them and each of them, neither work
            exclude group:'org.slf4j'
            exclude group:'org.apache.logging.log4j', module:'log4j-slf4j-impl'
    }
}

also this way

configurations.all {
    // tried both them and each of them, neither work
    exclude group: 'org.slf4j', module: 'dexkiller'
    exclude group:'org.apache.logging.log4j', module:'log4j-slf4j-impl'
}

Someone told me try

configurations {
    compile.exclude module: 'spring-boot-starter-logging'
}

It just avoided the multiple SLF4J bindings conflicts, but I'd like use my slf4j not the slf4j from soot jars.

Answer 1

A jar-with-dependencies should not be used as dependency. If you have any influence on that, correct that. Otherwise you might try to exclude the whole jar with dependencies and add the included dependencies one-by-one again until your project works.