[sc00ty]

How do you handle transitive dependencies?

[mooreds]

When you are importing a jar file (this is a java build tool) you have to specify the provenance of every dependency, and any dependency of those dependencies.

It's a real pain, but the pain is all upfront.