Gradle TransitiveDependency Version Conflict

Question

I've been implementing an extending pdf-creation API for an existing project using PDFBox. In order to use PDFBox I need to include following dependency in my build.gradle:

implementation('com.tom_roush:pdfbox-android:1.8.10.0')

One of the dependencies the existing project is using is spongycastle for crypto components:

implementation 'com.madgag.spongycastle:bcpkix-jdk15on:1.58.0.0'

So I first included both dependencies to my build.gradle file and tried to build the application. This is the exception I'm receiving:

Program type already present: org.spongycastle.cert.CertRuntimeException Message{kind=ERROR, text=Program type already present: org.spongycastle.cert.CertRuntimeException, sources=[Unknown source file], tool name=Optional.of(D8)}

I assumed this problem occurs because of a version conflict due to transitive dependencies of pdfbox, which are the following:

I tried to solve the problem using the dependency-exclude in my build.gradle:

implementation('com.tom_roush:pdfbox-android:1.8.10.0'){
exclude group:'com.madgag.spongycastle'
}

Because, as far as i know, I'm not using crypto aspects directly in my pdfbox implementation.

Answer 1

Thanks a lot - I've been able to solve the problem using a different approach.

configurations.all {
resolutionStrategy {
    dependencySubstitution {
        substitute module('com.madgag.spongycastle:pkix:1.54.0.0') with module('com.madgag.spongycastle:bcpkix-jdk15on:1.58.0.0')
    }
}

This solved my problem.

Answer 2

You can try to force predefined versions

configurations.all { 
    resolutionStrategy {
        failOnVersionConflict()
        force 'com.magdag.spongycastle:prov:1.58.0.0'
        force 'com.magdag.spongycastle:core:1.58.0.0'
    }
}

It might also a change in libraries due to versions. Maybe a deleted or renamed file. You can also try to force 1.54.0.0 versions