Blocker Non productized dependency gets pulled when product bom is used
There are not-whitelisted artifacts without expected string redhat suffix, see:
/tmp/app-generated-skeleton/target/lib/io.netty.netty-transport-native-unix-common-4.1.49.Final.jar
Maven repo zip contains productized dependency of netty-transport-native-unix-common
unzip -l ~/Downloads/rh-quarkus-1.7.3.ER13-maven-repository.zip | grep native-unix-common 0 09-25-2020 04:15 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/ 0 09-25-2020 04:15 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/ 16630 09-25-2020 04:10 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001.pom 40 09-25-2020 04:10 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001.pom.sha1 33560 09-25-2020 04:11 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001.jar 40 09-25-2020 04:11 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001.jar.sha1 55530 09-25-2020 04:14 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001-sources.jar 40 09-25-2020 04:14 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001-sources.jar.sha1 56939 09-25-2020 04:15 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001-linux-x86_64.jar 32 09-25-2020 04:15 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001.pom.md5 32 09-25-2020 04:15 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001.jar.md5 32 09-25-2020 04:15 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001-sources.jar.md5 32 09-25-2020 04:15 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001-linux-x86_64.jar.md5 40 09-25-2020 04:15 rh-quarkus-1.7.3.GA-maven-repository/maven-repository/io/netty/netty-transport-native-unix-common/4.1.49.Final-redhat-00001/netty-transport-native-unix-common-4.1.49.Final-redhat-00001-linux-x86_64.jar.sha1
But BOM references community one:
<dependency> <groupId>io.netty</groupId> <artifactId>netty-transport-native-unix-common</artifactId> <version>4.1.49.Final</version> </dependency> <dependency> <groupId>io.netty</groupId> <artifactId>netty-transport-native-unix-common</artifactId> <version>4.1.49.Final</version> <classifier>linux-x86_64</classifier> </dependency>