title: Grade not resolving transitive dependencies for Tika via artifactory
body: <p>I am working towards releasing the first truly useful version of <a href="https://github.com/nsoft/jesterj" rel="nofollow noreferrer" title="JesterJ">JesterJ</a> and have hit a major snag with dependency resolution. The kind folks at Jfrog have been good enough to recognize my open source efforts with free access to Artifactory Pro and so I am using it to inspect and validate the licenses of my transitive dependencies. I use an Apache 2.0 license so I am attempting to use <a href="https://www.apache.org/legal/resolved.html#criteria" rel="nofollow noreferrer">Apache's own standard</a> for compliance with it's 2.0 licenses. However, one of the dependencies, Apache Tika 1.12, had some "category X" dependencies 1.12 was released around the time of some changes to that policy I think and newer versions of Tika have corrected these dependency issues.</p>
  
  <p>The logical solution is to upgrade my Tika dependency. Unfortunately this has not gone well. When I upgraded Tika to 1.15 (or 1.16 now) I found that I no longer got the transitive dependencies from tika-parsers, including not getting tika-core which causes compile issues. Here's the gradle dependenccies output with 1.12:</p>
  
  <pre><code>+--- org.apache.tika:tika-parsers:1.12
  |    +--- org.apache.tika:tika-core:1.12
  |    +--- org.gagravarr:vorbis-java-tika:0.6
  |    |    \--- org.apache.tika:tika-core:1.5 -&gt; 1.12
  |    +--- com.healthmarketscience.jackcess:jackcess:2.1.2
  |    |    +--- commons-lang:commons-lang:2.6
  |    |    \--- commons-logging:commons-logging:1.1.3 -&gt; 1.2
  (etc)
  </code></pre>
  
  <p>And changing nothing other than the 2 to a 6 in my gradle build I get:</p>
  
  <pre><code>+--- org.apache.tika:tika-parsers:1.16
  +--- org.apache.solr:solr-solrj:5.5.0
  |    +--- commons-io:commons-io:2.4
  |    +--- org.apache.httpcomponents:httpclient:4.4.1
  |    |    +--- org.apache.httpcomponents:httpcore:4.4.1
  (etc)
  </code></pre>
  
  <p>This problem lies somewhere at the intersection of Artifactory/Gradle and may be related to the fact that Tika has begun including their pom files in META-INF in recent versions.</p>
  
  <p>Things I have tried - </p>
  
  <ol>
  <li>Moving to gradle 4.0 (no change) </li>
  <li>Adding MavenCentral to my libs-release virtual repository ahead ofJCenter (no change)</li>
  </ol>
  
  <p>I notice that the maven-central-cache repository in Artifactory does not cache the pom for 1.16 but does cache the pom for 1.12. If anyone can tell me how to get artifactory to cache/serve the pom or get gradle to ask for it properly (not sure which is the issue) that would be helpful.</p>
  
  <p>Full build file configuration is visible here: 
  <a href="https://github.com/nsoft/jesterj/blob/273c99a0bceccda7f0933299c699232fec1079ad/code/ingest/build.gradle" rel="nofollow noreferrer">https://github.com/nsoft/jesterj/blob/273c99a0bceccda7f0933299c699232fec1079ad/code/ingest/build.gradle</a></p>
  
  <p>Anonymous access to the jetsterj artifactory here:
  <a href="https://jesterj.jfrog.io/jesterj/webapp/#/home" rel="nofollow noreferrer">https://jesterj.jfrog.io/jesterj/webapp/#/home</a></p>